Optimize runner distribution: move security scans and E2E to GitHub

- Security scans run faster on GitHub runners than self-hosted
- E2E tests are minimal (1 scenario) so GitHub runners are sufficient
- Only keep Docker builds on self-hosted since they're resource intensive
- Results in faster CI execution and better cost efficiency

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -91,12 +91,10 @@ jobs:
         GITHUB_WEBHOOK_SECRET: 'test-secret'
         GITHUB_TOKEN: 'test-token'
 
-  # E2E tests - most complex, run on self-hosted for better performance
+  # E2E tests - only 1 scenario, run on GitHub for simplicity
   test-e2e:
     name: E2E Tests
-    runs-on: [self-hosted, Linux, X64]
-    # Security: Only run on self-hosted for trusted sources
-    if: github.event.pull_request.head.repo.owner.login == 'intelligence-assist' || github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
     
     steps:
     - name: Checkout code
@@ -156,12 +154,10 @@ jobs:
         name: codecov-umbrella
         fail_ci_if_error: false
 
-  # Security scans - run in parallel with tests
+  # Security scans - run on GitHub for faster execution
   security:
     name: Security Scan
-    runs-on: [self-hosted, Linux, X64]
-    # Security: Only run on self-hosted for trusted sources
-    if: github.event.pull_request.head.repo.owner.login == 'intelligence-assist' || github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
     
     steps:
     - name: Checkout code

.github/workflows/security-audit.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   security-audit:
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     name: Security Audit
     
     steps:

.github/workflows/security.yml

@@ -12,7 +12,7 @@ on:
 jobs:
   dependency-scan:
     name: Dependency Security Scan
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     
     steps:
     - name: Checkout code
@@ -36,7 +36,7 @@ jobs:
 
   secret-scan:
     name: Secret Scanning
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     
     steps:
     - name: Checkout code
@@ -54,7 +54,7 @@ jobs:
 
   codeql:
     name: CodeQL Analysis
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read