Re-enable self-hosted runner

[gipert]

• isolation: deploy daemon in a Docker container? @ManuelHu
• restart daemon
• update workflow: move validation job config to a dedicated workflow file and upload validation report to github pages ci: move self-hosted runner workflow parts to a dedicated file #533

repo settings:

• block pushes/deletions on main (repository admins can bypass this)
• all users that are not a member or owner of this repository and not a member of the legend-exp organization will require approval to run workflows.
• only this repository can use the self-hosted runner (forks are therefore excluded)
• runner settings: only the .github/workflows/validation.yml workflow can be run by the self-hosted runner

Relevant docs: https://docs.github.com/en/actions/reference/security/secure-use#hardening-for-self-hosted-runners