ci: add guarded Nexus runner selection

[neuralnexus]

Summary

• Adds variable-driven Nexus selection for the workflow jobs below.
• Nexus is considered only for push, schedule, or workflow_dispatch on the repository default branch.
• Pull requests (including same-repository PRs), tags, non-default refs, and all other events keep the GitHub-hosted fallback.
• If a selector variable is unset, the job stays on its listed hosted runner.
• Existing job topology is unchanged; only runner routing and the preferred hosted fallback change.
• No source, dependency, or application behavior is changed.

Runner routing

Workflow / job	Nexus selector variable	Hosted fallback
ci.yml / validate	NEXUS_RUNS_ON_LINUX	ubuntu-26.04
ci.yml / browser-packages	NEXUS_RUNS_ON_UBUNTU_26_04_BROWSER	ubuntu-26.04
ci.yml / safari	NEXUS_RUNS_ON_MACOS_15_ARM64_DEVELOPER	macos-15
pages.yml / build	NEXUS_RUNS_ON_LINUX_JQ	ubuntu-26.04
pages.yml / deploy	NEXUS_RUNS_ON_LINUX	ubuntu-26.04

• NEXUS_RUNS_ON_LINUX selects the generic Linux/X64 Nexus fleet.
• NEXUS_RUNS_ON_LINUX_JQ selects the validated jq-capable Linux/X64 Nexus fleet.
• NEXUS_RUNS_ON_MACOS_15_ARM64_DEVELOPER selects the validated developer-tooling macOS 15/ARM64 Nexus fleet.
• NEXUS_RUNS_ON_UBUNTU_26_04_BROWSER selects the validated browser-capable Ubuntu 26.04/X64 Nexus fleet.

Validation

• The diff is limited to 2 root-level GitHub Actions workflow files; every non-routing line, if any, matches a reviewed validation repair.
• Every Nexus expression uses the canonical default-branch trust gate and a GitHub-hosted fallback.
• git diff --check passes.
• actionlint passes across the repository workflows.