feat(ci): add runner selection (build-matrix + array runs-on)

[monsieurleberre]

Pre-open

• pre-open review completed — findings addressed locally or explicitly deferred below

Deferred: input validation for the array-string runs-on on go-ci / terraform-ci / build-and-test — a malformed value already fails the run loudly (the fromJSON template error), the value comes from the trusted caller's own workflow file, and adding a validation job to each workflow would put an extra check in every caller's graph. Disproportionate to the risk.

Summary

Adds runner-selection capability to the public reusable CI workflows so org repos can move CI onto self-hosted runners (e.g. the Hetzner pool) and support cross-platform matrices, added additively — every existing @v1 caller behaves identically.

Changes

• csharp-ci.yaml / scala-ci.yaml: new optional build-matrix input (JSON array of { name, runner, coverage } shards) that fully replaces os-list when set. A new normalize job runs scripts/normalize-ci-matrix.sh to compute the effective matrix, feeding build-and-test via strategy.matrix.include; runs-on: ${{ matrix.runner }} accepts a string or an array of labels; coverage-gated steps switch from if: matrix.os == 'ubuntu-latest' to if: ${{ matrix.coverage }}.
• scripts/normalize-ci-matrix.sh (new, tested): maps build-matrix or os-list to one effective matrix JSON. The os-list path reproduces today's behaviour bit-for-bit. Fails loud with a ::error:: annotation on a malformed matrix (>1 coverage shard, missing/empty name/runner, non-boolean coverage, non-array, invalid JSON, empty result).
• go-ci.yaml / terraform-ci.yaml: runs-on now also accepts a JSON array string (e.g. '["self-hosted", "hetzner"]') in addition to a plain label.
• build-and-test.yaml: new runs-on input (empty-safe — it also runs on push/pull_request where inputs is empty); also wires the new test into the shell-test step.
• README / CHANGELOG: documents the new inputs and adds a "Selecting runners" section.

Back-compat

Callers passing only os-list (or nothing) get an identical build-and-test job graph and identical coverage behaviour. The one visible graph change is an added normalize matrix check on csharp-ci / scala-ci callers.

Testing

• test/normalize-ci-matrix_test.sh — 28 cases (back-compat, precedence, all fail-loud paths, ::error:: annotations). Runs in CI via build-and-test.yaml.
• actionlint v1.7.7 clean on all workflows; shellcheck clean on the new script + test; existing route-nuget-push_test.sh still green.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.