feat(ci): keep GitHub-hosted runner labels current through the updater

The workflows pin `runs-on: ubuntu-NN.NN`, so no job moves to a new Ubuntu
release behind our back, but nothing raised the pin either. A sixth job of
`🔄 Update versions` closes that: `utils/update/runner.py` reads the image
table of actions/runner-images, takes the newest x64 Ubuntu label whose
image carries no preview or beta badge, and raises every older bare
`runs-on: ubuntu-NN.NN` to it; arch-suffixed labels stay untouched. The job
opens the change as one PR over `.github/workflows`, so its CI run tests
the new image before it reaches main.

This commit carries the updater's first result: every job now runs on
ubuntu-26.04 (49 `runs-on`).

actionlint 1.7.12, the newest release, does not know `ubuntu-26.04` yet
(rhysd/actionlint#682, fix proposed in rhysd/actionlint#743), so
`.github/actionlint.yaml` declares the label until a release knows it.

act maps each `ubuntu-NN.NN` label the workflows use to the local platform
image, derived from `.github/workflows`, instead of a fixed list that did
not know ubuntu-26.04.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/update/test_runner.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from utils.cache.files import read_text
+from utils.update.runner import bump_text, bump_workflows, newest_ubuntu_label
+
+_BADGE = "<br>![Endpoint Badge](https://img.shields.io/endpoint?url=x)"
+_PREVIEW = "[![preview](https://img.shields.io/badge/preview-0969DA)](https://x)"
+_README = "\n".join(
+    [
+        "| Image | Architecture | YAML Label | Included Software |",
+        "| --------------------|--------------|---------------------|------------------|",
+        f"| Ubuntu 28.04 {_PREVIEW}{_BADGE} | x64 | `ubuntu-28.04` | [ubuntu-28.04] |",
+        f"| Ubuntu 26.04{_BADGE} | x64 | `ubuntu-26.04` | [ubuntu-26.04] |",
+        f"| Ubuntu 26.04 Arm64{_BADGE} | arm64 | `ubuntu-26.04-arm` | [x] |",
+        f"| Ubuntu 24.04{_BADGE} | x64 | `ubuntu-latest` or `ubuntu-24.04` | [x] |",
+        f"| Ubuntu Slim{_BADGE} | x64 | `ubuntu-slim` | [ubuntu-slim] |",
+        f"| macOS 26 Arm64{_BADGE} | arm64 | `macos-26` | [macOS-26-arm64] |",
+    ]
+)
+
+
+class TestNewestUbuntuLabel(unittest.TestCase):
+    def test_picks_newest_ga_x64_label(self) -> None:
+        self.assertEqual("ubuntu-26.04", newest_ubuntu_label(_README))
+
+    def test_none_without_an_ubuntu_row(self) -> None:
+        self.assertIsNone(newest_ubuntu_label("| Image | x |\n| macOS | arm64 |"))
+
+
+class TestBumpText(unittest.TestCase):
+    def test_raises_older_and_keeps_newer(self) -> None:
+        text = (
+            "jobs:\n"
+            "  a:\n    runs-on: ubuntu-22.04\n"
+            "  b:\n    runs-on: ubuntu-24.04\n"
+            "  c:\n    runs-on: ubuntu-28.04\n"
+            "  d:\n    runs-on: ubuntu-24.04-arm\n"
+            "# runs on ubuntu-24.04 elsewhere\n"
+        )
+        self.assertEqual(
+            "jobs:\n"
+            "  a:\n    runs-on: ubuntu-26.04\n"
+            "  b:\n    runs-on: ubuntu-26.04\n"
+            "  c:\n    runs-on: ubuntu-28.04\n"
+            "  d:\n    runs-on: ubuntu-24.04-arm\n"
+            "# runs on ubuntu-24.04 elsewhere\n",
+            bump_text(text, "ubuntu-26.04"),
+        )
+
+
+class TestBumpWorkflows(unittest.TestCase):
+    def test_rewrites_only_changed_files(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "old.yml").write_text("runs-on: ubuntu-24.04\n", encoding="utf-8")
+            (root / "new.yml").write_text("runs-on: ubuntu-26.04\n", encoding="utf-8")
+
+            changed = bump_workflows(root, "ubuntu-26.04")
+
+            self.assertEqual([root / "old.yml"], changed)
+            self.assertEqual(
+                "runs-on: ubuntu-26.04\n", read_text(str(root / "old.yml"))
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()