ci: migrate safe jobs to self-hosted runner

.github/workflows/dependabot-auto-merge.yml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   auto-merge:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     if: github.actor == 'dependabot[bot]'
     steps:
       - name: Dependabot metadata

.github/workflows/security.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   # Verify commit signatures on PRs
   verify-signatures:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     if: github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@v4
@@ -46,7 +46,7 @@ jobs:
 
   # Dependency review for PRs
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     if: github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@v4

.github/workflows/validate.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   validate:
     name: Validate
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
 
     strategy:
       fail-fast: false