[TueJon]

Public PR tests currently run as vd alongside host deployment credentials. Route them to the prepared ci-public account, which has no sudo/Docker access and cannot traverse /home/vd. Keep fork guards and approval requirements, and verify the account boundary in each run.

Validation: this PR runs the existing full CI on the isolated runner. Host rollout is tracked by vdfw-runner-privilege-separation-2026-10-22; existing runner retirement follows green main/deploy evidence and the required host approval.

The site deployment job stays on vd with the separate tuejon-deploy label and its existing forced-command key. Merge is held for production cutover approval; no site files change. Labels route jobs and do not prevent an approved malicious workflow from targeting the deploy runner.

[TueJon]

Verdict: ship_it — no blocking findings at 33c0e33.

Reviewed the exact head. Diff is limited to .github/workflows/site.yml; no site file or target-owned handler is touched. Exact-head CI: test passed on runner vd-fw-webmcpify-at-public (labels tuejon-ci,ci-public), including the new Verify runner isolation step; deploy is skipped for PR events as expected.

Notes (non-blocking):

1. deploy now needs the tuejon-deploy label, which no runner carries yet — the live runner list for this repo is vd-fw-webmcpify-at (tuejon-ci) and vd-fw-webmcpify-at-public (tuejon-ci,ci-public). The merge commit itself triggers a push deploy, so the label must be added to site runner id 2 before merge (cutover step 3 in knowledge/vd-fw/public-ci-runner-isolation.md). That is host rollout, not a change required in this PR; flagging only to keep merge order explicit.
2. The isolation assertions are host-coupled by design (account ci-public, no sudo/docker groups, no /home/vd access via ACL + ProtectHome). They currently pass and fail closed if the unit/ACL regresses; changing the runner account or path layout later will require updating this step.
3. Residual, already stated in the PR body: an approved fork workflow can still edit runs-on and select the privileged tuejon-deploy runner — labels are routing, not authorization. Not introduced by this diff.

CI is green at this head; no further source change requested.