ci: point inherited workflows at ubuntu-latest, prune upstream-only bots

[calebjacksonhoward]

Fixes the CI defect tracked in mostlyharmless-ai/watercooler-cloud#1100 (this fork has issues disabled, so it's tracked in the consuming repo).

Problem

The workflows inherited from upstream getzep/graphiti request the runner label depot-ubuntu-22.04 — upstream's paid Depot fleet, which this fork has no access to. unit-tests, pyright (typecheck), ruff (lint), and mcp-server-tests therefore queue indefinitely, and no fork PR can go green on inherited CI. PRs #1–#3 merged on local-suite-parity evidence instead — and since watercooler-cloud now pins fork commits into the product, every future graphiti change pays this tax.

Changes

• unit_tests.yml (both jobs), typecheck.yml, lint.yml, mcp-server-tests.yml: runs-on: depot-ubuntu-22.04 → ubuntu-latest. The depot-NAT workaround comments/steps are left in place — they are harmless on ubuntu-latest and keeping them minimizes drift from upstream.
• Removed upstream-only bots (per the fix scoped in the tracking issue):
  • cla.yml — CLAAssistant; needs upstream's CLA_APP_PRIVATE_KEY, and CLA collection is meaningless on our fork.
  • pr-triage.yml — upstream's Claude triage; needs their ANTHROPIC_API_KEY.
  • ai-moderator.yml — spam-labels issues (disabled on this fork) and minimizes comments on PRs; upstream-hygiene bot with no value here.
• Left untouched: the release-* workflows still reference depot-ubuntu-24.04-small, but they only trigger on release events and the fork does not publish releases. codeql.yml already uses ubuntu-latest.

Verification

This PR is itself the test: as a same-repo PR, the pull_request-triggered workflows run from this branch's workflow files, so unit-tests / typecheck / mcp-server-tests should actually execute (not queue) on ubuntu-latest. Note lint.yml triggers on pull_request_target and runs from main's workflow file — it will only pick up the new runner after merge.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[calebjacksonhoward]

Reviewed latest head e5e0b4fba793dd523f5da3955ba8e34f512c246a.

I do not have blocking findings from this pass. The inherited CI jobs that need to run on normal fork/same-repo PRs now target ubuntu-latest, and the upstream-only bots being removed are the ones currently requiring upstream-specific app/API secrets or issue/PR hygiene behavior that this fork does not use.

Verification:

• gh pr diff 4 reviewed.
• Current checks show the pull_request workflows that this branch can affect are executing on GitHub-hosted runners: unit-tests, database-integration-tests, pyright, live-mcp-tests, and CodeQL are passing.
• CLAAssistant and triage are still failing on this PR because they are pull_request_target workflows evaluated from main; deleting them in this branch cannot affect those checks until after merge. Same for ruff still being pending from main's pull_request_target workflow.
• git diff --check origin/main...HEAD passed.
• Parsed all remaining .github/workflows/*.yml files successfully with PyYAML.