[chandarith-chea]

Summary

• ci.yml Build and test now runs on the self-hosted label dockiva: GitHub's actions/runner (linux/arm64) in a Dockiva container on the maintainer's Mac.
• Pull requests from forks always use GitHub-hosted ubuntu-24.04, so outside code never runs on the Mac.
• Fallback: set the repository variable CI_RUNNER=hosted to send every run to ubuntu-24.04. Without it, runs wait in the queue until the Mac and Dockiva are back.
• scripts/ci-runner/ holds the runner image, a launchd loop that registers one single-use JIT runner per job (fresh container each time, no stored GitHub credential), and setup docs.
• release.yml is unchanged and stays on hosted runners.

Dockiva workarounds in the runner image

• The runner runs as root: after sudo apt-get update (apt's _apt sandbox sets no_new_privs), later sudo calls in the same container lose root on the current engine.
• dpkg skips the uppercase netfilter headers (xt_CONNMARK.h vs xt_connmark.h): the released engine stores files case-insensitively. The fix is on engine main (af61a4e), not yet released.
• The job container gets 8 GiB (-m 8g). The engine's 2 GiB default OOM-killed a cold cgo go test ./....
• build-essential and pkg-config are installed because wails' gtk3 code needs cgo, as on hosted Ubuntu.

Test plan

• Runner image builds and starts on Dockiva; the JIT runner registers, takes one job, exits, and the loop registers the next.
• This PR's Build and test passes on the dockiva runner (run 42575163253, 6.5 min with a cold arm64 Go cache; the setup-go cache save took 2.7 min of that).