PR #34849 - manaflow-ai/cmux

Problem

Status-report workflows were still choosing hosted or paid fallback routes even when the live fleet had capacity. The pr-red-checks-comment and ci-guards report consumers now use the same portable placement snapshot as light job execution, so an idle fleet Linux runner or owned mini is tried first for the current attempt.

This PR is stacked on #34615 (codex/light-routing) and should be retargeted to feat-cmux-next after that PR lands.

What changed

Added portable-placement bootstraps for pr-red-checks-comment#comment and ci-guards#guard-status.
Reused CI_RUNNER_STATE with contents: read; no App token, secret, or workflow permission was added.
Kept fork branches first and existing hosted/paid fallbacks intact.
Added CI_PORTABLE_LIGHT_JOBS_OFF=1 as an emergency kill switch; default behavior is on.
Guard bootstrap waits for the five guard jobs before rollup execution.
Declared both consumers and their bootstraps in the runner registry.

The placement snapshot is intentionally fail-open for long-running workflows: a stale snapshot falls through to the existing fallback instead of blocking a report.

Performance

Metric	Before	After	Delta	Harness
Idle-mini status-report coverage	0/2	2/2	+2 jobs	`Wiring.test_status_reports_consume_live_capacity_without_a_routing_app`

Leo asked, “how’s CI? we still have bigger wins we can get? what’s the state of it all? more things we can skip/do better”. This slice removes avoidable hosted/paid placement for status reports while preserving a one-line rollback switch.

Validation

router-review (gpt-6-astra high): SHIP at abed44b8af99e8bb24ff14b5546de6b8a1b18d6a.
Scoped placement, routing-table, fork-routing, runner-set and shell-guard checks passed.
Fleet fast-checks reached setup/admission for this exact head; terminal job logs were unavailable after the shared API quota floor, so no fleet green is claimed here.

🤖 Generated with Codex

Agent session: agent session

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Moves pr-red-checks-comment and ci-guards status reports to use live light capacity so an idle fleet Linux runner or owned mini is placed before hosted or paid fallbacks.

Adds portable-placement bootstraps that read CI_RUNNER_STATE with contents: read; no App token, secret, or new workflow permission, plus a wiring test asserting both reports consume an idle mini without secrets.
Falls back to the existing hosted/paid route when the snapshot is stale or CI_PORTABLE_LIGHT_JOBS_OFF=1 is set.
Keeps forks on ephemeral runners; guard-status waits for the five guard jobs before placement, and the comment bootstrap runs only on feat-cmux-next base PRs.