ci: swap Blacksmith x86 → ARM for CI and security jobs

CI runs lint/typecheck/test; security runs osv-scan (and pip-audit for
python). No Docker artifacts produced. ARM is cheaper and faster for
Bun/Python tooling. publish.yml stays on ubuntu-latest for trusted
publishing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vvillait88

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   ci:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
     steps:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v7

.github/workflows/security.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   osv-scan:
     name: Dependency Scan
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1
@@ -31,7 +31,7 @@ jobs:
 
   pip-audit:
     name: Python Audit
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1