QVAC-14347 infra: centralize CI runner labels in a shared catalog

[GSServita]

🎯 What problem does this PR solve?

• The pinned Windows image (windows-2022) is hardcoded across build.yml's Windows jobs. A hosted-image migration (e.g. windows-2022 → windows-2025) means grepping and hand-editing every job, and it is easy to miss one.
• This is the qvac-ext-stable-diffusion.cpp rollout of QVAC-14347's runner-label centralization (already landed in the monorepo, piloted on qvac-ext-ggml).

📝 How does it solve it?

• Adds .github/runners.yaml as the single source of truth for specialized runner labels.
• Generates .github/workflows/reusable-runner-names.yml (via .github/scripts/sync-runner-names.mjs) that exports each catalog entry as a job output. runs-on: evaluates before any step runs, so a reusable workflow's outputs are the only way to feed it a centrally-defined label.
• Rewires build.yml's two Windows jobs to add a runner_names job and read runs-on: ${{ needs.runner_names.outputs.windows_2022 }}.
• Rolling -latest aliases and matrix.os identities stay hardcoded — they are GitHub aliases / frozen logical identities, not fleet labels.
• Adds runner-names-validate.yml + .github/scripts/validate-runner-names.mjs + unit tests that fail if the generated workflow drifts from the catalog or if a wired workflow hardcodes a catalog target. Docs: .github/RUNNERS.md.

🧪 How was it tested?

• node .github/scripts/validate-runner-names.mjs → ok (1 target, 1 workflow)
• node --test .github/scripts/test/runner-names.test.mjs → 9/9 pass
• actionlint on the reusable + validate workflows → clean (the pre-existing actions/checkout@v3 / github-script@v3 warnings in build.yml are untouched by this PR and out of scope)

🛡️ Permissions changes

• Scope: new runner_names caller job in build.yml, the new validate job in runner-names-validate.yml, and the reusable workflow reusable-runner-names.yml (top-level).
• Before: n/a (new jobs / new workflow)
• After: permissions: contents: read
• Justification: least privilege — the export job needs nothing beyond read; the validate job only checks out and runs node.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.