[ice-zeus]

CI-SelfHosted task CIOD-12: the label switch for the on-demand runners (one fresh DigitalOcean droplet per job).

Stacked on #5 (ci/pool-workflow, the workflow this PR relabels): it targets that branch and moves to main after #5 merges (GLOBAL 3.12).
Do not merge before the cutover. This PR stays a draft and unmerged until the cutover session (CIOD-R1), which merges it head-pinned while the old pool is stopped. Project orchestrators do not merge it.

Change

• runs-on per job: changes and docs on ci-2cpu; lint, test, android and linux on ci-4cpu; actionlint.yaml lists ci-2cpu, ci-4cpu and ci-8cpu.
• Job names are unchanged, so required checks stay valid.
• Comments about the old pool's labels and its machine-slot wait now describe the one-job runners.
• timeout-minutes values are unchanged. Their old slot margin stays until the CI-SelfHosted reports show each job's time on the new runners; trimming them is a follow-up.
• $CI_CACHE_DIR/<repo>/... paths are unchanged (the variable keeps its meaning on the new runners).

Labels: ci-2cpu is 2 dedicated vCPU / 4 GB; ci-4cpu is 4 vCPU / 8 GB, the same CPUs as today's machines.

Validation

• Every edited workflow and actionlint config parses as YAML.
• actionlint, with the new labels allowed, reports no new finding compared with main. Its only findings are pre-existing shellcheck info items.
• No old pool label remains under .github/.
• The PR's own CI runs on the new labels once it is marked ready (at the cutover). That run is the per-repository proof.

Documentation

• Workflow comments are updated in place.
• Prose docs that still name the old labels are left to the project (follow-up), because rendered-doc checks would need a re-render.