ci: drop the self-hosted runner

.claude/rules/ci.md

@@ -43,14 +43,12 @@ paths:
 ## Runners
 
 - Xcode jobs run on `xcode-27`, a GitHub preview image. `setup-xcode` pins the Xcode build.
-- Release Build runs on `mac-mini-m4pro` (`self-hosted`, `macOS`, `ARM64`, `tablepro-release`), the maintainer's Mac, as the maintainer's user. `gh variable set MAC_RUNNER --body github` moves it to `xcode-27`; `gh variable delete MAC_RUNNER` moves it back.
-- Signing, notarization and the feed stay on hosted runners.
-- Any workflow on a pushed ref can target that label: never approve a fork PR run that changes `.github/` unread.
+- Every job runs on a GitHub-hosted runner. There is no self-hosted runner.
 - At most 5 hosted macOS jobs and 20 jobs in all run at once.
 
 ## Release Build
 
-- `release-build.yml` builds and packages the app and every registry plugin as a tag does, unsigned: nightly at 19:00 UTC, Sundays at 07:00 UTC on `xcode-27`, and by dispatch. No tag waits for it.
+- `release-build.yml` builds and packages the app and every registry plugin as a tag does, unsigned, on `xcode-27`: nightly at 19:00 UTC and by dispatch. No tag waits for it.
 
 ## Summaries
 

.github/actions/setup-xcode/action.yml

@@ -7,8 +7,8 @@ inputs:
     required: false
     default: "false"
 
-# The only place the version and build are written. The bundle name differs by machine
-# (Xcode_27.1_Release_Candidate.app on xcode-27, Xcode.app on a Mac), so it is found by its version.plist.
+# The only place the version and build are written. The image names the bundle by its own scheme
+# (Xcode_27.1_Release_Candidate.app on xcode-27), so it is found by its version.plist.
 runs:
   using: composite
   steps:

.github/actions/setup-xcodegen/action.yml

@@ -10,8 +10,7 @@ runs:
       # generated pbxproj output differs between XcodeGen versions. install.sh copies
       # both bin/xcodegen and share/xcodegen/SettingPresets; without the presets,
       # generation silently drops build settings and still exits 0.
-      # It goes to the runner's tool cache, not /usr/local: the self-hosted Mac has no
-      # passwordless sudo, and the xcodegen already on its PATH is Homebrew's, unverified.
+      # It goes to the runner's tool cache, not /usr/local, so it needs no sudo.
       env:
         XCODEGEN_VERSION: "2.46.0"
         XCODEGEN_SHA256: "4d9e34b62172d645eed6457cac13fc222569974098ef4ee9c3368bedf0196806"

.github/workflows/release-build.yml

@@ -1,30 +1,21 @@
 name: Release Build
 
 # The Release configuration of the app and every registry plugin, universal and unsigned, packaged
-# the way a tag packages it, so a packaging failure shows before the tag: nightly on main, weekly on
-# the hosted runner, and on demand.
+# the way a tag packages it, so a packaging failure shows before the tag: nightly on main and on
+# demand.
 
 on:
   schedule:
     - cron: '0 19 * * *'
-    # Always hosted, so the MAC_RUNNER fallback stays tested. runs-on matches this string.
-    - cron: '0 7 * * 0'
   workflow_dispatch:
-    inputs:
-      runner:
-        description: Where the build runs. default follows the MAC_RUNNER repository variable.
-        type: choice
-        options: [default, self-hosted, github]
-        default: default
 
 permissions:
   contents: read
 
 jobs:
   build:
     name: Release Build
-    # The dispatch input wins, then the weekly schedule, then MAC_RUNNER; unset is the Mac.
-    runs-on: ${{ (inputs.runner == 'github' || (inputs.runner != 'self-hosted' && (github.event.schedule == '0 7 * * 0' || vars.MAC_RUNNER == 'github'))) && 'xcode-27' || fromJSON('["self-hosted", "macOS", "ARM64", "tablepro-release"]') }}
+    runs-on: xcode-27
     timeout-minutes: 150
     # The tag's version settings run here first; 9999999 is the largest build at MAJOR 0 (apple/RELEASING.md, Versions).
     env: