feat(guards): wire runner-isolated — self-guards step, consumer entry, changelog (#58)

.github/workflows/ci.yml

@@ -52,8 +52,9 @@ jobs:
     uses: ./.github/workflows/release-exercise.yml
 
   # The self-guards (issue #11): this repo eats exactly what it serves. The
-  # three guard actions run against the REAL tree — VERSION, CHANGELOG.md,
+  # guard actions run against the REAL tree — VERSION, CHANGELOG.md,
-  # drills/ — through the same `uses:` steps every consumer's CI carries.
+  # drills/, .github/workflows/ — through the same `uses:` steps every
+  # consumer's CI carries.
   # These steps are also the composite-action wiring proof (issue #5's
   # acceptance criterion: action.yml resolving, $GITHUB_ACTION_PATH, the
   # relative lib sourcing) that action-exercise carried with scratch files
@@ -73,6 +74,7 @@ jobs:
       - uses: ./actions/changelog-armed
       - uses: ./actions/changelog-monotonic
       - uses: ./actions/drill-recorded
+      - uses: ./actions/runner-isolated
 
   # Exercises changelog-monotonic the way a consumer does, against a
   # CONSTRUCTED history. The self-guards job above runs the same action on

CHANGELOG.md

@@ -8,6 +8,7 @@ so entries say what changed, cite the issue, and stop.
 
 - `needs-ruling` — the cross-cutting flag for a pending human decision, excluded from `state:needs-human` and from the staleness sweep (#51).
 - Cross-repo doctrine: the panel is the PR's repo's roster, a review request is authorization but not panel membership, and `Part of <repo>#N` replaces the `Closes #N` that cannot cross repos (#57).
+- `actions/runner-isolated` — a `pull_request`-triggered job may never run on a self-hosted runner (#58).
 
 ## 0.1.0 — 2026-07-22
 

docs/CONSUMERS.md

@@ -70,6 +70,7 @@ the machinery at all:
        - uses: heavy-duty/ceremony/actions/changelog-armed@<pinned-tag>
        - uses: heavy-duty/ceremony/actions/changelog-monotonic@<pinned-tag>
        - uses: heavy-duty/ceremony/actions/drill-recorded@<pinned-tag>
+       - uses: heavy-duty/ceremony/actions/runner-isolated@<pinned-tag>
    ```
 
    `changelog-armed` and `drill-recorded` take
@@ -77,6 +78,15 @@ the machinery at all:
    inputs and defaults are in its `action.yml`
    ([actions/](../actions/)). Adopting the agent team flow adds the
    `docs-sync` step ([below](#adopting-the-agent-team-flow)).
+
+   `runner-isolated` asserts that no `pull_request`-triggered workflow
+   names a self-hosted runner — a PR workflow runs the branch's code, and
+   unreviewed fork code must never execute on your own hardware
+   ([#58](https://github.com/heavy-duty/ceremony/issues/58)). It fires on
+   the PR that first mixes a PR trigger and a self-hosted `runs-on` in
+   one file; the unblock is splitting the workflow. A repo with **no**
+   self-hosted runner still wants it: the guard's value is the day
+   somebody adds one.
 6. **Labels automation** (optional but recommended): the caller from
    [Labels automation](#labels-automation), plus `.github/labels.conf`
    (panel + the repo's `scope:*` rows) and `.github/labeler.yml` (the
@@ -323,9 +333,9 @@ Bumping the pin re-syncs the mirror in the same PR —
   [releases page](https://github.com/heavy-duty/ceremony/releases) is
   that section, verbatim). One bump PR updates **every** ceremony `uses:`
   reference in the repo to the new tag — the workflow callers *and* each
-  guard step; a release-only setup already has four (the
+  guard step; a release-only setup already has five (the
   [release caller](#release-workflow) plus the
-  [three CI guards](#bootstrap-a-new-repo)), and changing only one line
+  [four CI guards](#bootstrap-a-new-repo)), and changing only one line
   leaves the consumer split across ceremony versions, which the same-tag
   rule above forbids. A repo that has adopted the agent team flow
   additionally bumps the mirror in the same PR —