Emit custom runs-on label arrays for self-hosted runners (#387)

[avidenic]

Closes #387.

What

Adds a public RunsOnLabels (string[]) to GitHubActionsAttribute so a generated workflow can target a self-hosted runner pool by label array — runs-on: [self-hosted, linux, x64] — instead of only the fixed GitHubActionsImage enum scalar.

[GitHubActions(
    "deploy",
    GitHubActionsImage.UbuntuLatest, // mandatory; ignored for runs-on when RunsOnLabels is set
    On = [GitHubActionsTrigger.WorkflowDispatch],
    InvokedTargets = [nameof(Deploy)],
    RunsOnLabels = ["self-hosted", "linux", "x64"])]
public partial class Build : NukeBuild { /* ... */ }

deploy:
  name: ubuntu-latest
  runs-on: [self-hosted, linux, x64]
  steps:
    - uses: actions/checkout@v6
    # ...

How

1. GitHubActionsAttribute.RunsOnLabels (string[], defaults empty) → carried through GetJobs onto a matching GitHubActionsJob.RunsOnLabels.
2. GitHubActionsJob.Write branches: non-empty → runs-on: [a, b, c] via JoinCommaSpace(); otherwise the existing scalar runs-on: {Image.GetValue()} path is untouched.
3. Validated at configuration-generation time:
   • requires exactly one image — a multi-image matrix can't be disambiguated by a single label set, so it fails the build with a clear message rather than silently emitting N identical-runner jobs. (The constructor mandates an image regardless; when RunsOnLabels is set the image is ignored for runs-on: and only names the job.)
   • rejects null/empty/whitespace entries, which would otherwise emit malformed YAML such as runs-on: [a, ].

Per the issue, the property is named RunsOnLabels (not the fork's earlier RunsOnOptionalInputs). Job- and step-level runs-on and any GitHubActionsImage enum changes are out of scope.

Backwards compatibility

Purely additive. RunsOnLabels defaults to empty, so existing [GitHubActions(...)] usages generate byte-for-byte identical YAML (no runs-on: change). Non-breaking → target/2026, no breaking-change.

Testing

• runs-on-labels Verify snapshot in ConfigurationGenerationTest — locks the runs-on: [self-hosted, linux, x64] array form; the existing scalar snapshots are unchanged, guarding the fallback path.
• GitHubActionsRunsOnLabelsValidationTest: matrix+labels throws; single-image+labels and matrix-without-labels don't; single label is valid; null/empty/whitespace element throws.
• Full solution ./build.sh Test Pack is green locally, including the Nuke.* transition-shim test projects that consume this public API.

Merge preference: (x) squash (default) ( ) rebase