perf(ci): route jobs to the new capability-split runner scale sets

hermes-agent-ci-infra now offers three amd64 scale sets instead of one,
split by capability rather than size:

  arc-runner-set     no dind   4/8Gi     general (unchanged label)
  arc-runner-docker  dind      4/8Gi     needs a docker daemon
  arc-runner-small   no dind   500m/1Gi  short gates, warm pod

Of the 22 workflows targeting arc-runner-set, only docker.yml ever talks to
a daemon. Every other job was booting a privileged docker:dind sidecar, an
extra init container and a `docker info` startup probe just to run ruff, so
dind now lives only on arc-runner-docker (and arm64, which already had it).
docker.yml's amd64 legs and its manifest-merge job move there; the arm64
legs are unchanged.

The short gate jobs move to arc-runner-small. Each of these ran for 14-29s
while reserving 4 CPU / 8Gi — a fifth of a c3-standard-22 node — and there
are enough of them per PR to delay the test matrix they run alongside. The
small set sits on the always-on system pool and keeps one warm pod, so
these jobs skip pod creation and image pull entirely.

No behavior change to what any job does; only where it runs.

.github/workflows/docker.yml

@@ -49,7 +49,10 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: arc-runner-set
+            # dind lives only on arc-runner-docker now; the general amd64
+            # set dropped it so the ~20 workflows that never touch a daemon
+            # stop paying for a privileged sidecar on every pod.
+            runner: arc-runner-docker
             platform: linux/amd64
           - arch: arm64
             runner: arc-runner-arm64
@@ -197,7 +200,8 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: arc-runner-set
+            # See the build job: dind lives only on arc-runner-docker.
+            runner: arc-runner-docker
             platform: linux/amd64
           - arch: arm64
             runner: arc-runner-arm64
@@ -284,7 +288,8 @@ jobs:
   # ---------------------------------------------------------------------------
   merge:
     if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
-    runs-on: arc-runner-set
+    # Needs buildx to assemble the manifest list — see the build job.
+    runs-on: arc-runner-docker
     needs: [publish]
     timeout-minutes: 10
     environment: container-publish