.github/workflows: Migrate workflows to Blacksmith runners

.github/workflows/agent-guidance.yml

@@ -39,11 +39,11 @@ concurrency:
 jobs:
   contract:
     name: Ownership and context budgets
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup Node and pnpm
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/android.yml

@@ -28,11 +28,11 @@ jobs:
   smoke-android:
     name: Smoke Tests
     if: ${{ !github.event.pull_request.draft }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 80
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/apple.yml

@@ -29,7 +29,7 @@ jobs:
   smoke-apple:
     name: Smoke Tests
     if: ${{ !github.event.pull_request.draft }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     # Keep each platform's former 80-minute ceiling, plus shared setup and cleanup.
     timeout-minutes: 170
     env:

.github/workflows/ci.yml

@@ -34,11 +34,11 @@ jobs:
   # runtime (#1976 / PR #2006), so it runs after Setup toolchain instead.
   lint-typecheck-package:
     name: Lint, Typecheck & Package
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       # #1976: ripgrep is never installed on ubuntu-latest, so `rg` failed with "command not
       # found" (exit 127) on every run, and `if rg ...; then ... fi` cannot distinguish that
@@ -127,14 +127,14 @@ jobs:
   # asserts.
   repo-guards:
     name: Repo Guards & Compatibility
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       # The layering ratchets (R6/R9/R10) measure the merge-base with origin/main, which a
       # shallow checkout cannot reach. Fallow, replay-compat, and daemon-wire-compat need full
       # history or tags.
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -281,11 +281,11 @@ jobs:
   # thresholds, so a separate unit-tests job would rerun the same tests.
   coverage:
     name: Coverage
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 0
 
@@ -363,11 +363,11 @@ jobs:
 
   integration:
     name: Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/concurrency-torture-nightly.yml

@@ -36,7 +36,7 @@ concurrency:
 jobs:
   torture:
     name: Session/lease/lock torture sweep
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     env:
       TORTURE_RUNS: ${{ github.event.inputs.runs || '5000' }}
@@ -48,7 +48,7 @@ jobs:
       TORTURE_ENVELOPE: ${{ github.workspace }}/torture-results/envelope.json
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/conformance-differential.yml

@@ -45,7 +45,7 @@ env:
 jobs:
   differential-ios:
     name: iOS Conformance Differential
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     timeout-minutes: 90
     env:
       IOS_RUNTIME_VERSION: '26.2'

.github/workflows/conformance-regenerate.yml

@@ -28,11 +28,11 @@ concurrency:
 jobs:
   regenerate-verify:
     name: Regenerate & Verify Fixtures
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       # regenerate.mjs itself needs only Node builtins, but the verify step below
       # parses corpus flows with the live engine, which imports the `yaml`

.github/workflows/deploy.yml

@@ -25,13 +25,13 @@ jobs:
   deploy:
     # Only main publishes to gh-pages, whichever way the run starts.
     if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
       pages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           persist-credentials: true
 

.github/workflows/docs.yml

@@ -52,11 +52,11 @@ concurrency:
 jobs:
   check:
     name: Prose, internal links, and heading anchors
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup Node and pnpm
         uses: ./.github/actions/setup-node-pnpm
@@ -82,11 +82,11 @@ jobs:
   # command's docs, fails here instead.
   command-docs:
     name: Command reference doc coverage
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup Node and pnpm
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/linux.yml

@@ -27,7 +27,7 @@ jobs:
   smoke-linux:
     name: Smoke Tests
     if: ${{ !github.event.pull_request.draft }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     env:
       # Force X11 mode (Xvfb) — no Wayland on CI.
@@ -40,7 +40,7 @@ jobs:
       GTK_MODULES: 'gail:atk-bridge'
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/mutation-affected.yml

@@ -58,13 +58,13 @@ env:
 jobs:
   select:
     name: Select harness validation kernels
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     outputs:
       modules: ${{ steps.select.outputs.result }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 0
 
@@ -107,7 +107,7 @@ jobs:
     name: Mutants (${{ matrix.name }})
     needs: select
     if: needs.select.outputs.modules != '[]'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -116,7 +116,7 @@ jobs:
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         timeout-minutes: 2
@@ -155,11 +155,11 @@ jobs:
     name: Affected decision-kernel mutants
     needs: [select, mutants]
     if: always() && needs.select.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 0
 

.github/workflows/mutation-weekly.yml

@@ -28,7 +28,7 @@ concurrency:
 jobs:
   shard:
     name: Mutants (${{ matrix.name }})
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     # Bound setup and mutation separately, leaving headroom for evidence and upload.
     timeout-minutes: 30
     strategy:
@@ -59,7 +59,7 @@ jobs:
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         timeout-minutes: 2
@@ -98,13 +98,13 @@ jobs:
 
   report:
     name: Mutation score report
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: shard
     if: always()
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/perf-nightly.yml

@@ -65,7 +65,7 @@ jobs:
   perf-ios:
     name: iOS Command Perf
     if: ${{ github.event_name == 'schedule' || github.event.inputs.ios == 'true' }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     timeout-minutes: 100
     env:
       IOS_RUNTIME_VERSION: '26.2'
@@ -172,11 +172,11 @@ jobs:
   perf-android:
     name: Android Command Perf
     if: ${{ github.event_name == 'schedule' || github.event.inputs.android == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 100
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm

.github/workflows/pr-cancel-on-close.yml

@@ -13,7 +13,7 @@ jobs:
   cancel:
     # A fork PR's token is read-only, so it cannot cancel runs.
     if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
       - name: Cancel the PR's unfinished runs

.github/workflows/publish-mcp-registry.yml

@@ -26,15 +26,15 @@ permissions:
 jobs:
   publish-mcp-registry:
     name: Publish MCP Registry
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     env:
       MCP_PUBLISHER_VERSION: v1.8.1
       MCP_PUBLISHER_ASSET: mcp-publisher_linux_amd64.tar.gz
       MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
 

.github/workflows/release-android-snapshot-helper.yml

@@ -25,14 +25,14 @@ permissions:
 jobs:
   publish-android-snapshot-helper:
     name: Publish Android Snapshot Helper
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     env:
       # The helper build refuses to guess its build-tools version on CI.
       AGENT_DEVICE_ANDROID_BUILD_TOOLS: 36.0.0
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
 

.github/workflows/release-ios-runner.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   publish-ios-simulator-runner:
     name: Publish iOS Simulator Runner
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     timeout-minutes: 90
     env:
       AGENT_DEVICE_XCUITEST_PLATFORM: ios