ci(runners): move every job to the 1-vCPU ubuntu-slim runner

[potiuk]

Nothing this repository runs in CI is heavy. Measured on the current
4-vCPU image:

Job	Runtime
prek	131s
analyze (python) / (actions)	99s / 41s
sandbox-lint	~88s
rat	60s
pytest (dev) / (vetted-ops)	20s / 18s
validate skills and tool contracts	18s
list-workspace-members	6s
tests-ok	3s

Paying for four cores to run a YAML linter and a 20-second pytest suite
is waste on infrastructure the foundation shares.

ubuntu-slim is GitHub-hosted (1 vCPU, 5 GB) rather than an ASF
self-hosted label, so it needs no Infra ticket — and 114 workflow files
across the apache org already use it. Jobs run in a container instead of
a dedicated VM and are killed at 15 minutes; the slowest job here uses 15%
of that budget, so the headroom survives the single-core slowdown.

Two jobs needed a fix to survive the move

zizmor ran through a Docker action. zizmorcore/zizmor-action's
action.sh runs the tool with docker pull + docker run and aborts
with "Cannot run this action without Docker"; ubuntu-slim jobs are
themselves containers with no Docker daemon, so the job failed before
zizmor was ever invoked. The CLI now comes from the root uv workspace's
dev group, which also puts its version under the lockfile and the
[tool.uv] exclude-newer cooldown, same as prek. This supersedes #1167's
pin bump of that action, which the rebase dropped.

typos was OOM-killed. It reported a bare - exit code: 1 with no
output, which reads like a hook that lost its error message — but prek has
no exit code to report for a signal-killed process. typos' peak RSS scales
with the number of paths handed to a single invocation (~1.2 MB each), and
prek splits the file list across roughly cpu_count invocations. Measured
on this repo's ~4.9k tracked files, in a 1-vCPU ubuntu:24.04 container
(which is what ubuntu-slim is):

paths in one invocation	peak RSS
610	422 MB
1,219 (the 4-vCPU chunk)	925 MB
2,438	2,514 MB
4,876 (the 1-vCPU chunk)	5,754 MB
walk mode, no paths passed	21 MB

So the hook fit comfortably on four cores and went past the runner's
memory on one. pass_filenames: false plus a trailing . makes typos
walk the repo itself — the shape the lychee hook already uses — for a
flat ~21 MB whatever the core count. Coverage is unchanged: typos honours
.gitignore while walking, and this checkout has no untracked non-ignored
files. .venv/ joins .gitignore for the same reason.

Three consequences worth flagging for review:

• codeql.yml gives up its ubuntu-24.04 pin along with the four
  cores. Its Python analysis is the one genuinely CPU- and memory-bound
  job here, so it's the first place to look if a run starts timing out.
  Happy to leave that workflow pinned and on the fat runner if reviewers
  prefer.
• No workflow sets timeout-minutes, so slim's 15-minute kill becomes
  the effective timeout everywhere — stricter than the 6-hour default it
  replaces, and appropriate for a repo where every job finishes inside two
  minutes.
• uv tool install prek is unpinned, so pre-commit.yml tracks
  whatever prek is latest at run time. Not introduced here, but the typos
  diagnosis leaned on knowing the version, so it's worth a follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R3wLTXcKFLKiZE992K5UHr