Route macOS workflows to explicit runners

[shiny-code-bot]

Summary

• register and route routine macOS validation to the context-panel self-hosted runner labels
• pin release/App Store Connect upload workflows to explicit macos-26 instead of floating macos-latest
• add scripts/validate-release-xcode.sh so release jobs fail fast when the Xcode major does not match the App Store-supported train
• document the runner/Xcode policy and record it in .github/github.json

Runner setup

• Added local repo runner context-panel-mac27-1 on this host.
• GitHub reports it online with labels: self-hosted, macOS, ARM64, context-panel, macos-27, xcode-27.
• Use this runner for fast routine CI/CodeQL, not official uploads while App Store Connect is still on the Xcode 26 train.

How we know when Xcode 27 is supported

• Watch Apple App Store Connect release notes for explicit Xcode 27 acceptance, then update the release runner/image and validate-release-xcode.sh --required-major together.
• Run a controlled upload canary before treating Xcode 27 as the normal release path.

Validation

• Ruby YAML parse for all workflow files
• jq empty .github/github.json
• bash -n scripts/validate-release-xcode.sh
• preflight rejects this Xcode 27 host when required major is 26
• preflight passes this Xcode 27 host when required major is 27
• git diff --check