ci: route workflows through Nexus runners

[neuralnexus]

Summary

• Route eligible jobs through Nexus variables only for trusted default-branch push, schedule, or workflow_dispatch events.
• Keep all other events on exact hosted fallbacks: ubuntu-26.04 for Linux and the existing macOS labels.
• Preserve the Linux browser/package and Pages jobs plus the exact macos-15 Safari fallback.

Configuration

• Leave NEXUS_RUNS_ON_LINUX unset because no compatible online Linux runner is visible.
• Leave NEXUS_RUNS_ON_MACOS_15_ARM64 unset because no matching online macOS runner is visible.

Validation

• Ruby YAML parse
• actionlint 1.7.12
• git diff --check
• Baseline comparison: job IDs and matrix rows preserved

[neuralnexus]

Implementation status:

• Commit 636de33 is based directly on current main; only 2 workflow files changed.
• Ruby YAML parsing, actionlint 1.7.12, git diff --check, and the job/matrix baseline comparison pass.
• Pull-request jobs resolve only to hosted fallbacks, so PRs cannot consume Nexus runner variables.
• NEXUS_RUNS_ON_LINUX remains unset because no compatible online Linux runner is visible.
• NEXUS_RUNS_ON_MACOS_15_ARM64 remains unset because no matching online macOS runner is visible.
• GitHub Actions completed successfully: https://github.com/neuralnexus/ByeBar/actions/runs/32618740990

[neuralnexus]

Runner-selector correction:

• Re-queried GET /repos/neuralnexus/ByeBar/actions/runners; it returns no exact visible online runner, so NEXUS_RUNS_ON_LINUX remains unset.
• The repository-variable API round-trip confirms that NEXUS_RUNS_ON_LINUX is absent.
• The PR branch contains no generic literal runner array, so no workflow commit or amend was required. Existing PR head remains 636de33.