fix(runner): default qualification builds to hosted cloud runners

Keep the EC2 option explicit, preserve maintainer authorization and immutable
source selection, and prepare only disposable hosted build disk. Record the
Claude/OpenAI API-only qualification milestone and deferred connection work.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -7,8 +7,15 @@ on:
         description: "Branch in this repository to build; resolved to one immutable commit before checkout"
         type: string
         required: false
+      execution_host:
+        description: "Cloud execution host; EC2 requires this workflow ref in the runner-group allowlist"
+        type: choice
+        options:
+          - github-hosted
+          - ec2
+        default: github-hosted
       publish_eval_image:
-        description: "Publish an immutable Daytona qualification image on the EC2 fleet (no provider credentials)"
+        description: "Publish an immutable Daytona qualification image in the cloud (no provider credentials)"
         type: boolean
         default: false
       candidate_provider:
@@ -19,15 +26,15 @@ on:
           - hermes
         default: none
       verify_source:
-        description: "Run broad source checks on EC2"
+        description: "Run broad source checks in the cloud"
         type: boolean
         default: false
       verify_public_install:
-        description: "Build and verify clean public npm installation on EC2 (no provider credentials)"
+        description: "Build and verify clean public npm installation in the cloud (no provider credentials)"
         type: boolean
         default: false
       build_eval_viewer:
-        description: "Build the canonical eval report viewer on EC2"
+        description: "Build the canonical eval report viewer in the cloud"
         type: boolean
         default: false
   pull_request:
@@ -105,9 +112,9 @@ jobs:
           echo "target_sha=$target_sha" >> "$GITHUB_OUTPUT"
 
   manual_image:
-    name: Build and verify on EC2
+    name: Build and verify in cloud
     needs: authorize_manual
-    runs-on: runs-on/fleet=paperclip-public-pr-x64/env=public-ci
+    runs-on: ${{ inputs.execution_host == 'ec2' && 'runs-on/fleet=paperclip-public-pr-x64/env=public-ci' || 'ubuntu-24.04' }}
     timeout-minutes: ${{ inputs.publish_eval_image && !inputs.verify_source && !inputs.verify_public_install && !inputs.build_eval_viewer && 45 || 90 }}
     permissions:
       contents: read
@@ -142,6 +149,16 @@ jobs:
         with:
           node-version: 24
           package-manager-cache: false
+      - name: Prepare disposable GitHub-hosted build disk
+        if: inputs.execution_host != 'ec2'
+        run: |
+          set -euo pipefail
+          test "$RUNNER_ENVIRONMENT" = github-hosted
+          test "$RUNNER_OS" = Linux
+          # These preinstalled SDKs are unrelated to this build. This VM is
+          # owned by this job and discarded afterward; no developer files exist.
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc
+          df -h "$GITHUB_WORKSPACE"
       - name: Resolve source dependencies without lifecycle scripts
         run: |
           pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
@@ -223,7 +240,7 @@ jobs:
             ' "$CANDIDATE_PROVIDER" "$SOURCE_SHA" > remote-verification/provider-pack-identity.json
           echo "$immutable" > remote-verification/image.txt
           echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
-      - name: Verify repository on EC2
+      - name: Verify repository in cloud
         if: inputs.verify_source
         # Leave time for artifact retention before the fleet's one-hour lifetime.
         timeout-minutes: 38