feat(cicd): codify persistent self-hosted runner fleets

[daniellam258]

Summary

• expand cmk:cicd trigger metadata for runner pools, capacity/concurrency, shared-host multi-project isolation, lifecycle, and cleanup
• add a progressively disclosed persistent-fleet reference covering one-agent-per-slot capacity, project-owned pools, GitHub access boundaries, ~/actions-runners/<project> layout, slot-scoped state, trusted bootstrap, lifecycle transactions, exact Docker ownership, and staged migration
• add behavioral evals for max-parallel semantics, shared-host isolation, and fail-closed systemd lifecycle; update the AI navigation doc

Core contract

A persistent runner agent accepts one job at a time. Capacity N therefore requires N separately configured agents/services; matrix strategy.max-parallel only caps workflow fan-out. Each pool has one project owner and exact filesystem, cache, service, routing, and cleanup boundaries. A shared Unix account/Docker daemon is explicitly operational isolation, not hostile-tenant security.

Verification

• bash scripts/skill-lint.sh
• git diff --cached --check
• npm run lint
• npm run type-check
• npm run build

Tracking

• DOPAN-1635
• distilled from the implementation and operational findings in DOPAN-1620