fix(ci): replace ubuntu-latest with runners-privilegedescalation (PRI-1825)

.github/workflows/ci.yaml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     timeout-minutes: 10
     container: node:22-slim
 

.github/workflows/dual-approval.yaml

@@ -14,7 +14,7 @@ on:
 jobs:
   promotion-gate:
     name: Promotion Gate
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     container: ubuntu:latest
     timeout-minutes: 5
 
@@ -94,14 +94,14 @@ jobs:
             exit 1
           fi
 
-          REVIEWER_APPROVED=$(printf '%s' "${REVIEWS}" | jq -r --arg user "${REQUIRED_REVIEWER}" \
+          REVIEWER_APPROVED=$(echo "${REVIEWS}" | jq -r --arg user "${REQUIRED_REVIEWER}" \
             '[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
 
           echo "${GATE_NAME} (${REQUIRED_REVIEWER}) approved: ${REVIEWER_APPROVED}"
 
           # Fallback: check if CTO approved as alternative for uat→main
           if [ "${REVIEWER_APPROVED}" != "true" ] && [ -n "${ALT_REVIEWER}" ]; then
-            REVIEWER_APPROVED=$(printf '%s' "${REVIEWS}" | jq -r --arg user "${ALT_REVIEWER}" \
+            REVIEWER_APPROVED=$(echo "${REVIEWS}" | jq -r --arg user "${ALT_REVIEWER}" \
               '[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
             if [ "${REVIEWER_APPROVED}" = "true" ]; then
               echo "CTO (${ALT_REVIEWER}) approved as fallback for UAT gate."

.github/workflows/renovate.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 jobs:
   renovate:
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     steps:
       - uses: actions/checkout@v4
       - uses: renovatebot/github-action@v40.3.0