projection: name the RedFlag Linux capability

Publication keeps the reviewed product tree still while its workflows request public-safe execution authority.

Source-Sha: a2b9bfe9f70e6fb3bf4e2060de7bd1106b955d6f

Policy-Sha: a2b9bfe9f70e6fb3bf4e2060de7bd1106b955d6f

Tree-Digest: f935dee0bf3929b9eb866dd2734081e467b32470c5a5991ed71fab184c8da675

.gitea/workflows/ci.yml

@@ -25,7 +25,7 @@ on:
 
 jobs:
   release-contract:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     container:
       image: debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
     steps:
@@ -45,7 +45,7 @@ jobs:
           echo "ADMISSION_SHELF_VERSION=admission-${GITHUB_RUN_ID}"
 
   go-vet:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -58,7 +58,7 @@ jobs:
         run: cd agent && go vet ./...
 
   go-test:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -71,7 +71,7 @@ jobs:
         run: cd agent && go test -race -count=1 ./...
 
   rust-test:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
@@ -89,7 +89,7 @@ jobs:
   # regressions (cfg(target_os), FFI, path assumptions) without needing
   # a runner per OS.
   cross-compile:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     strategy:
       fail-fast: false
       matrix:
@@ -155,7 +155,7 @@ jobs:
           fi
 
   web-build:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -169,7 +169,7 @@ jobs:
         run: cd web && npm ci && npm run build
 
   desktop-check:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -215,7 +215,7 @@ jobs:
           retention-days: 30
 
   installer-integrity:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -233,7 +233,7 @@ jobs:
   # documented allowlist (.govulncheck-allow, mirrored in SECURITY.md); npm gates the
   # production tree and treats dev-only advisories as warnings; cargo gates outright.
   dep-scan:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -278,7 +278,7 @@ jobs:
         run: scripts/dep-scan.sh
 
   commit-voice:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -315,7 +315,7 @@ jobs:
             --repository Fimeg/RedFlag
 
   action-pins:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Check for floating action refs
@@ -327,7 +327,7 @@ jobs:
           echo "All action refs are SHA-pinned."
 
   public-history:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     if: github.ref == 'refs/heads/public' || github.base_ref == 'public'
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -352,7 +352,7 @@ jobs:
   # a public-surface decision that shows up in this diff rather than in nobody's
   # memory.
   public-surface:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     if: github.ref == 'refs/heads/public' || github.base_ref == 'public'
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -375,7 +375,7 @@ jobs:
   # internal forge remains the only writer, and the result is read back
   # anonymously before any optional downstream moves.
   publish-forge:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     needs: [go-vet, go-test, rust-test, cross-compile, web-build, desktop-check, installer-integrity, dep-scan, commit-voice, action-pins, public-history, public-surface]
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/public' && github.event.inputs.publish_source == 'true'
     env:
@@ -456,7 +456,7 @@ jobs:
   # deliberately best-effort: a missing credential or divergent history is a
   # visible degraded mirror, never a failure of the canonical publication.
   mirror-downstreams:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     needs: [publish-forge]
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/public' && github.event.inputs.publish_source == 'true' && github.event.inputs.mirror_downstreams == 'true'
     env:

.gitea/workflows/msi-custody-proof.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   prove:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 

.gitea/workflows/nightly.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   nightly:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:

.gitea/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
   # Gate runs before any build. A tag that doesn't agree with the tree is a
   # broken release waiting to happen — fail here, not after artifacts exist.
   gate:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -189,7 +189,7 @@ jobs:
 
   # Build the web UI once — it's the same embed for every platform.
   web:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -217,7 +217,7 @@ jobs:
   # binary and signed into the release manifest. If this fails, `release` never
   # builds (it is in `needs`).
   dep-scan:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -245,7 +245,7 @@ jobs:
   # Build binaries for every target platform. The webui-dist and supply-chain
   # posture artifacts are downloaded into the embed paths before the server compile.
   release:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     needs: [gate, web, dep-scan]
     strategy:
       fail-fast: false
@@ -564,7 +564,7 @@ jobs:
   # Generic CI assembles one deterministic candidate and deposits it on the
   # package shelf. This token can write packages; it cannot publish a release.
   stage_package:
-    runs-on: ubuntu-latest
+    runs-on: redflag-linux-build
     container:
       image: debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
     needs: [release]