PR #4259 - callstack/agent-device

Summary

Run the publish job in release.yml on ubuntu-latest instead of a Blacksmith runner.
Since #4185 the nightly Release has failed at npm publish --provenance with a 422: Unsupported GitHub Actions runner environment: "self-hosted". Only "github-hosted" runners are supported when publishing with provenance. A stable release would fail the same way.
Every other Blacksmith job is unchanged. The trusted-publishing setup (id-token: write, npm-publish environment, scripts/release-publish.mjs) is unchanged.

mcp-registry (publish-mcp-registry.yml) also has id-token: write and stays on Blacksmith. It authenticates with mcp-publisher login github-oidc, which exchanges the workflow's OIDC token. It does not publish to npm and does not use sigstore provenance, so no runner-environment check applies. I found no evidence it needs a hosted runner. If the first stable release fails there, move it in a follow-up.
No other workflow uses --provenance. The repo has no workflow guard that covers runs-on, so I added no check.

pnpm check:affected --run passed on the exact pushed commit (exactCommit=true). The first run failed the slow-test gate on unrelated daemon tests while another worker's gate ran on the same host. The rerun passed.
The Release workflow ran on this PR in dry-run mode: run 42185955105 is green (Plan and Build passed, the rest skipped). It skips the publish job, so it does not prove provenance. It does validate the YAML, job graph and needs.
The post-merge nightly is the verification step. After merge, a maintainer triggers a nightly with workflow_dispatch on main and confirms every package publishes with provenance. I did not dispatch the Release workflow.

🤖 Generated with Claude Code