ci: run tests and analysis on self-hosted runners, builds stay on GitHub

[ZhuchkaTriplesix]

Stacked on #1101 (parallel test sections); retarget to dev once that is merged.

Summary

Tests and static analysis can run on our own Proxmox machine; builds stay on GitHub.

• ci.yml: the test-sections matrix and analyze choose their runner with
  runs-on: <PR from a fork> ? ubuntu-latest : fromJSON(vars.CI_RUNS_ON || "ubuntu-latest").
  • Pull requests from forks always run on GitHub-hosted runners, never on ours.
  • The repository variable CI_RUNS_ON is the switch: unset = GitHub-hosted (the default today, so merging this changes nothing by itself); ["self-hosted","linux","querya-ci"] = our runners; deleting it switches back without a PR.
  • On self-hosted runners the apt-get step is skipped (packages are installed once on the machine) and flutter test uses --concurrency=2, since four runners share one machine.
  • build-linux-release and all of release.yml (Windows, macOS with signing, Linux packages) are unchanged and stay on GitHub-hosted runners.
• scripts/ci/setup-runner.sh: idempotent setup for a Debian/Ubuntu VM or LXC: installs the test packages, creates an unprivileged runner user without sudo, registers N runners (querya-ci-1..N, label querya-ci) as systemd services.
• docs/ci-runners.md (linked from docs/README.md): how the runner is picked, the switch, repository settings, operating notes.

Already done outside this PR

• Repository setting Fork pull request workflows: Require approval for all external contributors (approval_policy = all_external_contributors).
• An empty Ubuntu 24.04 LXC querya-ci (8 cores, 16 GiB, 80 GiB, internal network) with this script copied to /root/setup-runner.sh. The runners are not registered yet, so nothing uses them until CI_RUNS_ON is set.

Rollout

1. Register the runners (scripts/ci/setup-runner.sh inside the container).
2. Merge this, then gh variable set CI_RUNS_ON --body '["self-hosted","linux","querya-ci"]'.