fix(ci): pr-light runs on an X64 clean-room runner (Refs #6239)

.github/workflows/ci.yml

@@ -194,10 +194,10 @@ jobs:
           setsid --wait bash scripts/check_ci_wait_cancel.sh
 
   # Noah 15:09Z (#5955): what a ready PR runs instead of x86-main. Text-only cheap checks (the x86-main steps that run
-  # before "install the toolchain") and the fat_driver self-test; no X64 label, no section, no cargo build.
+  # before "install the toolchain") and the fat_driver self-test; clean-room X64 runner, no section, no cargo build.
   pr-light:
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft != true }}
-    runs-on: [self-hosted, Linux, clean-room]
+    runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 60
     # The PR-only sections (guard-tree, pr-review-shadow, pr-review-sign) carry their own permissions blocks; one job token covers all.
     permissions: write-all

docs/roadmaps/entries/PMAT-6239.yaml

@@ -0,0 +1,19 @@
+- id: PMAT-6239
+  github_issue: 6239
+  item_type: task
+  title: 'ci: pr-light runs on an X64 clean-room runner, not gx10-build'
+  status: in_progress
+  priority: high
+  assigned_to: null
+  created: 2026-10-24T05:05:00Z
+  updated: 2026-10-24T05:05:00Z
+  spec: null
+  acceptance_criteria:
+  - 'pr-light runs-on is [self-hosted, Linux, X64, clean-room] and the mg-reuse wiring check pins that exact line'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: null

docs/roadmaps/roadmap.yaml

@@ -25954,3 +25954,22 @@ Not done, pending the ruling: moving the 31 fixture files to an obviously synthe
   - kind:code
   notes: 'Re-cut from the EMG-001 return of #5590; its step-profiler half already landed (a743e8c23d).'
   epic: 5510
+- id: PMAT-6239
+  github_issue: 6239
+  item_type: task
+  title: 'ci: pr-light runs on an X64 clean-room runner, not gx10-build'
+  status: in_progress
+  priority: high
+  assigned_to: null
+  created: 2026-10-24T05:05:00Z
+  updated: 2026-10-24T05:05:00Z
+  spec: null
+  acceptance_criteria:
+  - 'pr-light runs-on is [self-hosted, Linux, X64, clean-room] and the mg-reuse wiring check pins that exact line'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: null

scripts/ci_mg_reuse.sh

@@ -600,7 +600,7 @@ STUB
   wire x86-main-advisories "github.event.pull_request.draft != true && github.event_name != 'pull_request' }}"
   wire workspace-test-shard "github.event.pull_request.draft != true && github.event_name != 'pull_request' }}"
   wire pr-light "if: \${{ github.event_name == 'pull_request' && github.event.pull_request.draft != true }}"
-  wire pr-light 'runs-on: [self-hosted, Linux, clean-room]'
+  wire pr-light 'runs-on: [self-hosted, Linux, X64, clean-room]'
   wire workspace-test 'needs: [workspace-test-shard, mg-reuse-wt, pr-light]'
   wire x86-main-advisories 'advisory_gate.sh"'
   wire x86-main-advisories 'bash scripts/check_deny_exemptions_live.sh'
@@ -620,9 +620,9 @@ STUB
     awk -v j="  $2:" '$0 == j {f = 1; next} f && /^  [A-Za-z0-9_-]+:$/ {exit} f' "$1" 2> /dev/null \
       | awk '/^        run: \|$/ {r = 1; next} r && /^      - / {exit} r {sub(/^          /, ""); print}'
   }
-  # pr-light is the ONLY runner of the PR path: no heavy label (X64, mq) may sit on it.
-  if grep -qE 'X64|"mq"|\bmq\b' <<< "$(job pr-light | grep -m1 '^    runs-on:')"; then
-    fail=$((fail + 1)); echo "FAIL pr-light: runs-on carries a heavy label"; else pass=$((pass + 1)); fi
+  # pr-light is the ONLY runner of the PR path: no merge-queue label (mq) may sit on it. X64 is allowed (clean-room X64 pool, not the gx10 build host).
+  if grep -qE '"mq"|\bmq\b' <<< "$(job pr-light | grep -m1 '^    runs-on:')"; then
+    fail=$((fail + 1)); echo "FAIL pr-light: runs-on carries a merge-queue label"; else pass=$((pass + 1)); fi
   # Opus-A on #5964: the sections that run only for a PR (guard-tree incl. R-2 / 11.1, pr-review-shadow, pr-review-sign)
   # ran inside x86-main, which a PR no longer runs. pr-light must run all three, and the feeder must judge pr-light.
   for sec in guard-tree pr-review-shadow pr-review-sign; do