ci: route workflows to ARC runner scale sets

Run standard Linux workflows on the existing ARC runner set. Route the Docker
matrix by architecture so amd64 jobs use arc-runner-set and arm64 jobs use the
dedicated arc-runner-arm64 scale set. Use the baked Electron dependencies for
the desktop E2E job.

.github/workflows/docker.yml

@@ -28,12 +28,12 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-latest
+            runner: arc-runner-set
             platform: linux/amd64
             cache-from: type=gha,scope=docker-amd64
             cache-to: type=gha,mode=max,scope=docker-amd64
           - arch: arm64
-            runner: ubuntu-24.04-arm
+            runner: arc-runner-arm64
             platform: linux/arm64
             cache-from: type=gha,scope=docker-arm64
             cache-to: type=gha,mode=max,scope=docker-arm64

.github/workflows/docs-site-checks.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Install ascii-guard
         uses: ./.github/actions/retry
         with:
-          command: python -m pip install ascii-guard==2.3.0 pyyaml==6.0.3
+          command: python3 -m pip install ascii-guard==2.3.0 pyyaml==6.0.3
 
       - name: Extract skill metadata for dashboard
         run: python3 website/scripts/extract-skills.py

.github/workflows/e2e-desktop.yml

@@ -13,22 +13,15 @@ concurrency:
 jobs:
   e2e:
     name: Playwright E2E (Linux)
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # ── System deps for Electron on headless Ubuntu ───────────────────
-      # Electron needs GTK, NSS,atk, etc. even under xvfb. Playwright's
-      # install-deps covers browsers; for Electron we install the apt
-      # packages directly.
-      - name: Install system dependencies for Electron
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq \
-            xvfb \
-            libgtk-3-0 libnotify4 libnss3 libxss1 libxtst6 \
-            xdg-utils libatspi2.0-0 libdrm2 libgbm1 libasound2t64
+      # xvfb and Electron's GTK/NSS/audio libraries are baked into
+      # nousresearch/nous-gke-runner so this works in the ARC runner pod
+      # without requiring passwordless sudo.
 
       # ── Node ───────────────────────────────────────────────────────────
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/lint.yml

@@ -103,7 +103,7 @@ jobs:
         env:
           HEAD_REF: ${{ inputs.event_name == 'pull_request' && github.head_ref || github.ref_name }}
         run: |
-          python scripts/lint_diff.py \
+          python3 scripts/lint_diff.py \
             --base-ruff .lint-reports/base/ruff.json \
             --head-ruff .lint-reports/head/ruff.json \
             --base-ty   .lint-reports/base/ty.json \
@@ -159,4 +159,4 @@ jobs:
           python-version: "3.11"
 
       - name: Run footgun checker
-        run: python scripts/check-windows-footguns.py --all
+        run: python3 scripts/check-windows-footguns.py --all

.github/workflows/skills-index.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Build skills index
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: python scripts/build_skills_index.py
+        run: python3 scripts/build_skills_index.py
 
       - name: Upload index artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7