ci: support configurable runners for review and fixes

[svozza]

Aceiro hard-codes GitHub-hosted runners for every review and fix job, so a caller cannot use its own capacity when GitHub queues a run. On Rito PR #29, the initial review job waited 46 minutes while the same push’s CodeBuild validation started in 23 seconds.

Add an optional runner-labels JSON-array input to both reusable workflows and apply it to all 11 jobs, including permission checks and delivery. The default remains ["ubuntu-latest"]. Use uv’s Python 3.13 selection and automatic installation instead of Ubuntu-oriented actions/setup-python; the initial author check runs through uv without installing project dependencies. Existing job permissions, approval gates, dependency pins, and disabled caches remain in place.

Document CodeBuild labels, per-job compute overrides, isolated-runner requirements, and the remaining ownership and capacity checks before a consumer rollout. This PR enables runner selection; it does not change Rito’s callers or deploy AWS resources.

Validation:

• Workflow regression checks and type checking pass.
• Actionlint passes with the installed version’s lack of support for the existing job.workflow_sha / job.workflow_repository fields excluded.
• A disposable Amazon Linux 2023 x86-64 container, with no AWS or GitHub credentials, successfully bootstrapped Python 3.13.15 through uv, imported the frozen dependencies, and ran the bundled Claude CLI (2.1.220).
• Full deterministic suite: 2,316 passed, 2 skipped.

ARM CodeBuild execution and the cross-owner ritofactory → svozza/aceiro reusable-workflow routing still need a live smoke test before Rito switches runners.