Isolated GitHub pre-check runners

The runner lifecycle enters only through Stado:

stado runner install --profile precheck <registry-target>
stado runner status --profile precheck <registry-target>
stado runner remove --profile precheck <registry-target>

Stado resolves the host address and release_platform from the canonical registry. install exchanges GITHUB_TOKEN.value through Stado's admin-scoped Skarbiec coordinates for a short-lived organization registration token, transports the installer and token on host-channel stdin, verifies the pinned Actions Runner archive, and installs the OS service. It also makes the Brama host's Skarbiec reconcile missing routes from its live vault, resolves agent:probierz to the request-signing item and field selected by Skarbiec, reads that field on the host without putting its value in argv, and installs the resolved value through stdin as the runner-owned, mode-0600 .stado/kronika-agent-auth-secret; the non-secret probierz agent ID is published as $runner_root/routes/kronika-agent-id beside $runner_root/routes/brama.url. Kronika runs the audit, while Probierz is the Brama client identity authorizing that product workflow. remove uses a short-lived removal token before deleting the service, account, files, and network rule.

The runner has one unprivileged stado-precheck account and a root-owned pre/post-job cleanup hook. Workspaces, diagnostics, package and toolchain caches, application caches, and .stado are runner-owned; the rest of the installation is root-owned and not writable by jobs. An nftables UID rule on Linux and a PF user rule on macOS reject loopback, RFC1918, link-local, unique-local, and CGNAT/Tailscale ranges while leaving public GitHub and package endpoints reachable. The one exception is the exact loopback Brama port published by Stado for the authorized kronika consumer. Those CIDRs are protocol network classes compiled into Stado, not fleet host addresses; fleet destinations remain registry data.

GitHub runner group stado-precheck grants access to an explicit repository list. Stado keeps public-repository admission disabled until stado runner install <target> --profile precheck --repository <repository> registers against a named repository; those workflows must refuse pull requests whose head repository differs from the base repository before GitHub assigns the job to this runner. Eligible Linux jobs use runs-on: [self-hosted, Linux, X64, stado-precheck]; eligible macOS jobs use runs-on: [self-hosted, macOS, ARM64, stado-precheck]. Repository access is the GitHub-side boundary: workflow-ref restrictions remain disabled because same-repository pull-request jobs execute from refs/pull/*, not the default branch.