ci(docker-build): default the build job to FerrLabs runners on private FerrLabs repos

[BryanFRD]

Closes #341

runner now defaults to empty, resolved as ferrlabs-k8s when the calling repository is private and owned by FerrLabs, ubuntu-latest otherwise. An explicit runner still wins.

Callers checked: every FerrLabs private caller except one FerrLabs-Cloud call already passes runner, so they are unchanged. Public callers keep ubuntu-latest. BryanFRD/Finance and BryanFRD/Portfolio are private but outside the org, and the owner check keeps them on ubuntu-latest rather than on a label their account cannot reach.

[ferrfleet]

The expression itself is right: an explicit runner still wins, the empty default falls through, and the owner guard keeps BryanFRD/Finance and BryanFRD/Portfolio on ubuntu-latest rather than on a label their account cannot reach. github.repository_owner is the calling repository's owner in a nested workflow_call too, so reusable-release-rust → reusable-docker-build resolves against the original caller, and == on strings is case-insensitive in Actions, so the literal casing is not a trap.

One blocking item inline, plus three smaller ones.

Nit: helper-runner keeps the visibility-only default that its own description calls out as a hazard. A private caller outside the org that omits it gets ferrlabs-k8s-light for hadolint and cosign and ferrlabs-k8s for trivy and sbom, and those four jobs queue forever with no error, which is exactly the failure #341 names for the two BryanFRD repositories. Now that the owner check exists, the same && github.repository_owner == 'FerrLabs' on those four runs-on lines makes the whole workflow safe for them without their passing anything, and lets the paragraph in the helper-runner description shrink to a sentence. Out of this diff's scope, but it is half of the same bug.

Nit: reusable-release-rust.yml does not forward runner to its publish-docker job. It has its own runner input, and a private FerrLabs caller that sets it to ubuntu-latest still lands the image build on ferrlabs-k8s from here. Harmless before this change, since the image build was always ubuntu-latest; now the override is silently partial. runner: ${{ inputs.runner }} in that with: block forwards it, and an empty value still auto-resolves.

Nit: worth confirming the FerrLabs-Cloud call that inherits the new default builds linux/amd64 only. The platforms description says the ARC runners register no binfmt/qemu, so a caller that asked for multi-arch and was quietly fine on a hosted runner fails after this. The platforms default is single-arch, so this only bites if that call sets it explicitly.

[ferrfleet]

030f286 clears the blocking item, and the three smaller ones with it: the build default is ferrlabs-k8s-large, the four helper jobs carry the owner guard, reusable-release-rust forwards runner, and smoke-test-cmd no longer prescribes podman run. Approving.

Two things in what changed:

Nit: forwarding runner from reusable-release-rust couples two tiers through one input. Its own upload and publish-crate jobs want the medium pool; the docker build wants -large. A caller that sets runner: ferrlabs-k8s there to pin those two now also pins the buildah compile to medium, which is the demotion the blocking comment was about, reached from the caller side instead. Empty is the common case and resolves correctly, so nothing is broken today. If a caller ever needs to pin only the light jobs, add a separate docker-runner input on release-rust rather than widening this one.

Nit: reusable-release-rust's own two runs-on lines still read visibility alone, so a private caller outside FerrLabs queues forever on ferrlabs-k8s for upload and publish-crate. Same && github.repository_owner == 'FerrLabs' as the helper jobs. Its runner description also still says the auto-select is ferrlabs-k8s, which is now only half true given what it forwards.

The PR description still says the empty default resolves to ferrlabs-k8s; it is ferrlabs-k8s-large now.