ci: route trusted fork validation to dedicated runner

[futurenowlabs]

Summary

• add one fork-overlay heavy validation workflow for pushes to the protected Agent Platform baseline and trusted same-repository codex/** branches
• run full Linux check/test/build plus source-bound package byte-reproducibility on the dedicated repository-scoped self-hosted runner
• extend the existing actionlint configuration with only the two approved custom runner labels

Security and resource contract

• external/fork pull requests cannot trigger the self-hosted workflow because it has no pull_request, pull_request_target, or workflow_dispatch event
• permissions remain read-only and checkout uses persist-credentials: false
• the dedicated runner requires self-hosted, Linux, X64, openclaw-lab, openclaw-fork-ci
• Node 24.15.0 and pnpm 11.2.2 are exact, and Linux-native paths are proven before work
• no cache action, artifact upload, package publication, release, deployment, or secret input
• concurrency is branch-bounded and cancels superseded pushes
• existing hosted Workflow Sanity remains the independent lightweight semantic/security lane

Verification

• pinned actionlint v1.7.12 archive SHA-256 verified
• actionlint passed on the exact new workflow with the exact extended repository config
• negative source audit: no external/fork/manual trigger, no upload-artifact, no actions/cache
• workflow SHA-256: 8cd24240f94b46019d4db4042bb5604c93d3fd85f989643a21f626e3ac1d360c
• actionlint config SHA-256: 4751a7711cca7bec5da2e3951e679af38c8037e7d7ce009a20edcc2275b8947f

No OpenClaw product code, dependencies, release content, package publication, Platform state, staging, Telegram, users, schedules, or protected state changed.