ci: move workflows to GitHub-hosted runners (#83)

Public repos get standard GitHub-hosted runners for free. Jobs that need internal access already join the tailnet in their own steps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mike12806

.github/workflows/deploy.yml

@@ -11,7 +11,7 @@ env:
 
 jobs:
   deploy:
-    runs-on: self-hosted
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       id-token: write  # Tailscale + Vault logins through GitHub OIDC

.github/workflows/renovate-validate.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   validate:
     name: validate-renovate-config
-    runs-on: self-hosted
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read