ci: route trusted workflows through Nexus runners

[neuralnexus]

Summary

• Route trusted CI, DAST, CodeQL, and secret-scan runs through vars.NEXUS_RUNS_ON_LINUX.
• Keep pull requests on hosted ubuntu-26.04 and leave the PR-only dependency-review job unchanged.
• Preserve the CodeQL language matrix and ZAP container action.

Configuration

• Leave NEXUS_RUNS_ON_LINUX unset because no matching online Nexus runner is visible to this repository.

Validation

• YAML parse
• actionlint 1.7.12
• git diff --check
• Matrix/container handling, diff, and commit inspected against current main

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hexyr-com	444e6ee	Commit Preview URL Branch Preview URL	Aug 23 2026, 04:33 AM

[neuralnexus]

Implementation status (corrected runner selector):

• Commit 444e6ee remains unchanged. The workflows reference only vars.NEXUS_RUNS_ON_LINUX and contain no embedded self-hosted selector, so no new commit is required.
• GET /repos/neuralnexus/hexyr/actions/runners reports zero assigned runners.
• NEXUS_RUNS_ON_LINUX is unset; the variables API confirms no matching variable.
• YAML parsing, actionlint 1.7.12, and git diff --check pass; all reported PR checks passed.