fix(ci): pin the branch's own workflows to ubuntu-26.04

main rejects a moving runner label since 52ad8549e0, because ubuntu-latest moved to 26.04 in the middle of run 39166850273 and every job that landed on the new image met a different OS. These two workflows were written on this branch and still carried ubuntu-latest, so the branch broke its own target's rule.

The updater of b055eece05 did not catch them: it raises a bare runs-on: ubuntu-NN.NN and leaves everything else alone, and ubuntu-latest is neither that nor an arch-suffixed label. Pinning them hands them to the updater from here on.

One place stays outside its reach: the architecture ternary of call-images-build-ci.yml holds the label inside an expression, where the updater's runs-on: prefix does not match, so that pin has to be raised by hand until the pattern covers it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/README.md

@@ -195,7 +195,7 @@ architecture.
 
 The architecture is the one axis a deploy job cannot apply to itself: the distro
 is installed and the filesystem is built, but the CPU arrives with the runner.
-The matrix therefore carries the runner label with the row (`ubuntu-latest` for
+The matrix therefore carries the runner label with the row (`ubuntu-26.04` for
 amd64, `ubuntu-24.04-arm` for arm64), `runs-on` reads it, and the job asserts
 `uname -m` against what it was assigned before deploying anything, so a label
 that stops resolving to arm64 hardware fails loudly instead of reporting an

.github/workflows/call-images-build-ci.yml

@@ -48,7 +48,7 @@ concurrency:
 jobs:
   pools:
     name: 🏗️ Pools
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.out.outputs.matrix }}
       image_tag: ${{ steps.out.outputs.image_tag }}
@@ -70,7 +70,7 @@ jobs:
   build:
     name: 💿 Images ${{ matrix.architecture }}
     needs: pools
-    runs-on: ${{ matrix.architecture == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    runs-on: ${{ matrix.architecture == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-26.04' }}
     strategy:
       fail-fast: false
       matrix:
@@ -196,7 +196,7 @@ jobs:
     name: 🏷️ One tag per distro
     needs: [pools, build]
     if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/entry-pr-translate.yml

@@ -27,7 +27,7 @@ jobs:
   languages:
     name: 🗣️ Resolve machine-translatable languages
     if: vars.CI_ENABLE_AUTO_TRANSLATIONS == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       codes: ${{ steps.codes.outputs.codes }}
     steps:
@@ -53,7 +53,7 @@ jobs:
   extract:
     name: 📝 Extract catalogs
     if: vars.CI_ENABLE_AUTO_TRANSLATIONS == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: ⬇️ Checkout
@@ -86,7 +86,7 @@ jobs:
     needs:
       - languages
       - extract
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 340
     strategy:
       fail-fast: false