ci: every job on our own runners; Windows tests under wine, macOS off; one aggregate check

[shtse8]

Moves every job off GitHub-hosted runners to sylphx-linux-standard (owner standards/dx.md: our own runners in every repository, public or private; the billing budget stays $0). The release goes through SylphxAI/mcp-kit#8 (merged; v0 = 0.2.2). A build-only run on this branch built and checked all 5 binaries on our runners.

• release.yml gets a build-only dispatch input (gh workflow run release.yml -r <branch> -f build-only=true). It cross-compiles and checks all 5 binaries on our runners and publishes nothing. On a real release, only the npm publish job stays on a GitHub-hosted runner (trusted publishing needs one; owner decision).
• ci.yml: the 3-OS test matrix becomes test (Linux) plus test windows (wine): the tests are cross-compiled to MSVC with cargo-xwin and run under wine 11 (Ubuntu's wine 9.0 aborts in our VMs). macOS is off: we host no Apple hardware, and the release checks the Apple binaries. A new ci job is the one aggregate check. Every job has timeout-minutes, and checks sets up Node for the npm launcher smoke.
• Ruleset: the required checks move from the five per-job contexts (including test (macos-latest) and test (windows-latest)) to ci once this pull request is green.
• docs.yml (Pages), bench.yml and demo.yml run on our runners (demo installs fontconfig and headless Chromium's libraries, which the hosted image had), and the docs that said "GitHub-hosted runners" now say our Linux runners.

[shtse8]

Superseded: owner#750 clarified standards/dx.md. The goal is zero GitHub spend, not a ban on hosted runners. Public repositories may use GitHub's standard hosted runners (free for public repositories), so this repository stays on them. Closing without merging.