fix(ci): admit trusted review mention forwarding to self-hosted runners

[seonghobae]

RCA

PR #1026 current-head review request reached the dedicated control router successfully (run 36313606460), but its validate-and-forward successor (run 36313665190) still requests only ubuntu-24.04 and remains queued. Both mention forwarders are already explicitly allowed at refs/heads/main in the existing CWL MCP remediation runner group.

Change

Use that existing restricted self-hosted group only for central trusted-main workflow revisions, preserving the Ubuntu 24.04 fallback for branch revisions. These jobs validate payloads and publish/forward exact invocation receipts; they do not check out or execute PR source. No group policy, payload validation, deduplication or review gate changes.

Relates to #945 and #1026.

Verification

• GITHUB_ACTIONS=true targeted downstream/idempotency/payload/artifact/queue contracts: 91 passed.
• actionlint on both changed workflows: passed.
• git diff --check: passed.
• Regression requires central repository plus trusted-main binding and preserves hosted fallback; no PR checkout admitted.

Summary by CodeRabbit

• 변경 사항
  • 신뢰된 저장소의 main 브랜치에서는 검증 작업이 지정된 자체 호스팅 러너에서 실행됩니다. 그 외에는 ubuntu-24.04 러너를 사용합니다.
• 테스트
  • 저장소와 브랜치 조건에 따른 러너 선택 및 체크아웃 액션 미사용 여부를 확인합니다.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a4bad58d-6106-4020-b9dd-c3cc8706fe43

📥 Commits

Reviewing files that changed from the base of the PR and between 83111c8 and 4b9fc9f.

📒 Files selected for processing (3)

• .github/workflows/agent-mention-noema-dispatch.yml
• .github/workflows/agent-mention-opencode-dispatch.yml
• tests/test_agent_mention_downstream_idempotency.py

 ____________________________________________________________________________
< Great news: you fixed the bug. Bad news: you introduced its entire family. >
 ----------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}