CI: provision the self-hosted weather-ci runner

[Protonmatter]

Current state

The repository-side bootstrap work is complete.

• PR Make CI runner-ready: bootstrap gate, runner helper, runbook #17 added ci-bootstrap, the self-hosted workflow mappings, scripts/register_runner.sh, and docs/CI_RUNNERS.md.
• PR Require verified self-hosted runner packages #18 made runner installation fail closed on the package version, official SHA-256, repository registration URL, Python 3.12, service-mode prerequisites, and HTTPS-only verified download publication.
• ci-bootstrap and pr-fast are queued because no matching self-hosted runner is online. This is expected dispatch behavior, not a workflow defect.
• The former GitHub-hosted interim workflow was intentionally removed by PR Make CI runner-ready: bootstrap gate, runner helper, runbook #17.

Required host-side actions

1. Set repository variable PYPI_MIRROR_URL to the approved internal mirror before enabling the weather-ci label.

2. Prepare a dedicated non-root Linux x64 account with Python 3.12 and approved package egress.

3. In Settings → Actions → Runners → New self-hosted runner, obtain the short-lived registration token, the runner version offered to this repository, and the official Linux x64 SHA-256.

4. From a current checkout of main, run:

   RUNNER_URL=https://github.com/Protonmatter/global-weather-platform \
   RUNNER_TOKEN=<registration-token> \
   RUNNER_LABELS=weather-ci \
   RUNNER_VERSION=<version-from-repository-setup-page> \
   RUNNER_SHA256=<official-linux-x64-sha256> \
   RUNNER_AS_SERVICE=true \
   scripts/register_runner.sh

5. Use supervised administrator elevation for service installation. Do not grant persistent passwordless sudo to scripts under the user-writable runner directory.

6. Keep the registration token on the host; do not place it in GitHub, chat, tickets, or shell history.

Full runbook: docs/CI_RUNNERS.md.

Acceptance

• The runner appears online with self-hosted, Linux, X64, and weather-ci.
• ci-bootstrap completes successfully.
• pr-fast completes successfully using PYPI_MIRROR_URL.
• spec-validation completes successfully.
• Required branch protection identifies the authoritative checks.
• This issue can then be closed.

Deferred lanes

weather-build and weather-security require their own labels and the internal registry, attestation, and scan configuration documented in docs/CI_RUNNERS.md. Prefer separate runner groups or hosts where those lanes have different trust boundaries.

[Protonmatter]

Draft PR #8 reproduces the infrastructure state on current head 8c66694e674866ed43d00f493054359a71a17e3a: pr-fast run 29882224507 remains queued and pr-hosted-interim run 29882224516 failed before step 1. PR: #8

[Protonmatter]

Final draft PR #8 head e603b2ea5963a0cf86af010db5cc34c4d10a27a2 reproduces the same external blocker: pr-fast run 29883024042 is queued with zero steps, and pr-hosted-interim run 29883024061 failed before step 1 with zero steps and no log URL. No repository test command executed.

[Protonmatter]

Fresh retry after explicit authorization on 2026-07-22: hosted run 29883024061 created job 88829907061, which again completed failure with steps: null and no log URL. Self-hosted pr-fast job 88807728402 remains queued with steps: null. Repository-side retry is exhausted; the remaining work is Actions policy/billing and runner-host administration.

[Protonmatter]

Repository hardening is now on main via PR #18, squash commit a5a7ec23c688f7881d9ed1c545631ba364e53a0d. Independent Codex review found no major issues on the exact pre-merge head. The issue body now contains the definitive host-side registration sequence; keep this issue open until the queued gates execute successfully.