chore(ci): four per-PR runner reductions (dependency-review fold, selfhost push-only, one-runner previews, merged advisories)

[JSONbored]

Summary

Follow-up to #8514's unsharding, attacking the remaining per-PR runner fan-out at the source (observed today: 44-deep Actions queue with 3 running — the same starvation that stalled release-please and left #8506 conflicted for 1.5h).

1. security folds into changes (−1 slot on every PR). The dependency-review API check becomes a PR-only, draft-skipped step at the end of changes (which gains pull-requests: write solely for comment-summary-in-pr). validate's needs drops the job; a dep failure reddens validate through changes exactly as before, one job earlier. Branch protection unaffected (only validate + Superagent are required).

2. selfhost.yml goes push-to-main only (−~99 × 5.2 min/week). Its PR path list included migrations/**, so nearly every backend PR paid a docker build+boot. Pre-merge, ci.yml already enforces db:migrations:check, schema drift, and the selfhost pg integration suites; the boot smoke still runs on every main push (break caught minutes post-merge), and self-host users only consume tagged releases. Trade-off documented in the workflow header with a revisit condition (a hosted deploy tracking main).

3. Same-repo UI PRs deploy in ONE runner (−1 slot per UI push, ~100/wk). The trusted deploy half moves to a shared .github/actions/deploy-ui-preview composite (the setup-workspace precedent); ui-preview.yml gains an inline build-deploy job for same-repo PRs (same-repo = collaborator = secrets available), and ui-preview-deploy.yml becomes fork-only — its job's if compares head_repository to the base repo, so same-repo builds skip it without consuming a runner. The fork trust boundary is byte-for-byte preserved: fork code still builds with zero secrets and deploys only through the trusted workflow_run half, with the same bundle validation (symlink/structure/extension allowlist) now living in the composite both paths share. Bonus: the deploy job gained a trusted default-branch checkout, retiring the hand-synced hardcoded Node version.

4. The two calibration advisories merge into calibration-advisory.yml (−1 slot when both fired, one npm ci always). backtest-logic-check.yml + counterfactual-replay-check.yml had identical scaffolding and overlapping paths (src/services/ai-review.ts triggered both). One job now runs both halves; the replay half keeps its COUNTERFACTUAL_REPLAY_BUDGET spend guard and self-gates on the canonical prompt actually differing between base/head (which replaces its narrower path filter at the cost of two script invocations). The fail-open posture (#8105 — notice + green, never a red check) is preserved verbatim on every advisory step, fork-notice pairing included.

Net: every PR's floor drops 5 → 4 slots, UI PRs 7 → 5, migration-touching PRs lose the 5-minute docker job — on top of yesterday-today's unsharding (7 → 5), CodeQL removal, and cache-cleanup batching.

Validation

actionlint clean across all workflows; tsc --noEmit clean; full unit suite green (the one red file, miner-metrics-cli, was a stale local miner build artifact — passes after rebuild, untouched by this PR). Pinned CI-topology tests updated and passing: ci-skip-draft-prs (dependency-review step assertion + pinned absence of a resurrected security job), workflow-runner-labels (needs list, job slicing, selfhost concurrency group). Skill reference.md rows updated to match. The preview-pipeline change is validated structurally here; its first live exercise will be the next same-repo UI PR (Reviewbot reads the same Deployments API records, written by the same composite logic).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.53%. Comparing base (ac5ffbd) to head (dd720d5).
⚠️ Report is 22 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8523       +/-   ##
===========================================
+ Coverage   78.66%   92.53%   +13.87%     
===========================================
  Files         793      793               
  Lines       79483    79551       +68     
  Branches    24017    24039       +22     
===========================================
+ Hits        62526    73615    +11089     
+ Misses      13908     4799     -9109     
+ Partials     3049     1137     -1912     

Flag	Coverage Δ
backend	93.71% <ø> (?)
control-plane	99.85% <ø> (ø)
rees	88.56% <ø> (ø)
shard-1	?
shard-2	?

Flags with carried forward coverage won't be shown. Click here to find out more.
see 251 files with indirect coverage changes