ci: migrate 5 of 8 jobs to smithy self-hosted runners

[avrabe]

Summary

Migrates the bulk of synth's gating CI from GitHub-hosted runners to
the pulseengine self-hosted fleet (smithy). Five of the eight jobs in
ci.yml move to smithy; the remaining three stay on ubuntu-latest
for documented infra reasons (sudo apt, Kani-CBMC, Bazel + Nix +
Rocq) and are tagged in-place with the reason.

Coverage

Job	New runner	Class
test	smithy	rust-cpu
clippy	smithy	rust-cpu
coverage	smithy	rust-cpu
rivet	smithy	rust-cpu
fmt	smithy	light

Stays on ubuntu-latest

Job	Reason
verify	Needs sudo apt-get install libz3-dev; smithy has no sudo and libz3-dev is not yet in the toolchains role.
kani	Kani-CBMC bundle is not yet provisioned on smithy (tracked in playbook out-of-scope table).
bazel	Needs Nix + Bazel + Rocq, none of which are on smithy (tracked in playbook out-of-scope table).

Workarounds applied

None — every migrated job is a clean runs-on: swap. No installer
scripts, no sudo, no cargo-deny-action / cargo-semver-checks-action /
free-disk-space patterns in this workflow.

Test plan

• CI run completes; the five migrated jobs land on the matching
  smithy runner class within seconds (no GitHub queue).
• test, clippy, coverage, rivet succeed end-to-end on
  rust-cpu.
• fmt succeeds on light.
• verify, kani, bazel still run on ubuntu-latest exactly
  as before.

Rollback

Revert this commit. Every migrated job returns to ubuntu-latest and
the next run uses GitHub-hosted compute.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!