diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eada15d..2f42100 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, staging-runner]
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4219d9e..1fe8864 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,7 +10,7 @@ jobs:
   # Verify both packages build and pass tests, in lockstep.
   # If either fails, neither publishes.
   verify:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, staging-runner]
     steps:
       - uses: actions/checkout@v4
 
@@ -83,7 +83,7 @@ jobs:
   publish-npm:
     needs: verify
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, staging-runner]
     permissions:
       contents: read
       id-token: write
@@ -122,7 +122,7 @@ jobs:
     # still be able to push the matching PyPI artifact.
     needs: verify
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, staging-runner]
     permissions:
       contents: read
       id-token: write
diff --git a/src/analyst/finding-subject.ts b/src/analyst/finding-subject.ts
index 40ab41d..87f9ef9 100644
--- a/src/analyst/finding-subject.ts
+++ b/src/analyst/finding-subject.ts
@@ -108,16 +108,21 @@ export function parseFindingSubject(raw: string | null | undefined): FindingSubj
   if (trimmed.length === 0) return null
 
   // agent-knowledge:wiki:<slug>[#<heading>]
-  const wiki = trimmed.match(/^agent-knowledge:wiki:([a-z0-9][a-z0-9-]*)(?:#([a-z0-9][a-z0-9-]*))?$/)
-  if (wiki) return { kind: 'knowledge.wiki', slug: wiki[1]!, ...(wiki[2] ? { heading: wiki[2] } : {}) }
+  const wiki = trimmed.match(
+    /^agent-knowledge:wiki:([a-z0-9][a-z0-9-]*)(?:#([a-z0-9][a-z0-9-]*))?$/,
+  )
+  if (wiki)
+    return { kind: 'knowledge.wiki', slug: wiki[1]!, ...(wiki[2] ? { heading: wiki[2] } : {}) }
 
   // agent-knowledge:claim:<topic>
   const claim = trimmed.match(/^agent-knowledge:claim:(.+)$/)
-  if (claim && claim[1]!.trim().length > 0) return { kind: 'knowledge.claim', topic: claim[1]!.trim() }
+  if (claim && claim[1]!.trim().length > 0)
+    return { kind: 'knowledge.claim', topic: claim[1]!.trim() }
 
   // agent-knowledge:raw:<source-id>
   const raw_ = trimmed.match(/^agent-knowledge:raw:(.+)$/)
-  if (raw_ && raw_[1]!.trim().length > 0) return { kind: 'knowledge.raw', sourceId: raw_[1]!.trim() }
+  if (raw_ && raw_[1]!.trim().length > 0)
+    return { kind: 'knowledge.raw', sourceId: raw_[1]!.trim() }
 
   // agent-knowledge:stale:<slug>
   const stale = trimmed.match(/^agent-knowledge:stale:([a-z0-9][a-z0-9-]*)$/)
@@ -312,6 +317,8 @@ export const KIND_EXPECTED_SUBJECTS: Record<string, ReadonlyArray<FindingSubject
  * parse — emitting a malformed subject is a contract violation, not a
  * soft signal.
  */
-export const FindingSubjectStringSchema = z.string().refine((s) => parseFindingSubject(s) !== null, {
-  message: 'subject does not match the finding-subject grammar',
-})
+export const FindingSubjectStringSchema = z
+  .string()
+  .refine((s) => parseFindingSubject(s) !== null, {
+    message: 'subject does not match the finding-subject grammar',
+  })