GitHub Actions runners on arm64, AL

## Original requirement (verbatim) > Make sure Jaah nodes can install and work on Graviton-based AWS instances, earlier version of Ubuntu. It is ok if some features might not work, such as microVM. Should work with the same installation command with any arch specifics inside the bootstrap Operator scope additions (verbatim, PRD task 11088): "Install higher version of python on older versions of Ubuntu." · "Also add to scope Amazon Linux two latest versions." (resolved: AL2023 + the newest after it = AL2027 preview, architecture O2) · "Both graviton and x64 must work on supported versions of ubuntu or amazon linux" · "24.04 is supposed to have rootless Docker. Double check the sources" **Supported matrix S** (single home: `packaging/linux-support.toml`, created by the Foundation child "Report Linux distro/arch, gate capabilities"): x86_64 + aarch64 × Ubuntu 22.04, 24.04, 26.04, Amazon Linux 2023, Amazon Linux 2027 (preview) = 10 cells. Design inputs (read with `task_read`): PRD = task 11088, architecture = task 11089. §/D/R references below are the architecture's; C-n are the PRD's acceptance criteria. D18 applies to every build child: prove pre-merge with unit/integration tests plus container tests (`docker run --platform linux/{amd64,arm64}` under qemu binfmt, mem-26702 method); post-merge, after Jaah Deploy to dev succeeds, launch the child's own EC2 cells and fix forward. Operator answer O5 (architecture): "GitHub Actions runners on arm64 / Amazon Linux: make them work, or report unavailable?" → **Make it work in this epic**. ## Scope (architecture Child G; D14, R10) 1. `infra/host/gha-runners/install.py` hard-codes `actions-runner-linux-x64` (`:79-82`): pin the runner tarball **per arch** (`linux-x64`, `linux-arm64` of the same `RUNNER_VERSION`), each with its own sha256. 2. `HOST_PACKAGES` (`:247-272`) and the Playwright Chromium libraries (`:274+`): give each entry a per-package-manager name `{apt: …, dnf: …}`, installed through `infra/jaah/pkgmgr.py`. An entry with no AL package is installed from a pinned upstream binary, never skipped silently. If a Playwright library cannot be satisfied on an AL arch, report a GHA readiness failure naming the library. 3. Unattended-upgrades units (`:294-301`): on AL use `dnf-automatic` (`dnf-automatic-install.timer`, reboot off). 4. No `gha_runners` restriction row is added. Credentials & reach: - GHA job oracle: a runner registers on the test node and runs one job — dev console → node → **GitHub Actions runners** tab; credential `me/users/roman@gmind.tech/github_admin` — **credential verified**; **target repo deferred**: dev has no GHA pool yet and creating or choosing a GitHub repo is outward-facing. The GHA child asks the operator for the repo in one round (header `External`) before its post-merge cell; the sweep child reuses it. If declined, GHA cells are recorded **unproven against O5**, never done. - Launch and terminate tagged EC2 test cells (post-merge) — `me/jaah/system/bootstrap-admin` → assume `OrganizationAccountAccessRole` in the `jaah-dev` org account, `us-east-1` — **verified** (broker fetch succeeded; `sts get-caller-identity` returned the assumed role in jaah-dev). O4 authorises mutations, limited to instances tagged `jaah:test=task-<id>`. - AMIs for every cell — SSM public parameters `/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-{x86_64,arm64}`, `…/al2027-preview-ami-kernel-7.1-{x86_64,arm64}`, `/aws/service/canonical/ubuntu/server/...` — **verified** (listed from h2). - Dev console UI and API, incl. C-7 API refusals — `org/console/dev-login` (operator) at `https://app.dev.jaah.ai` — **verified** (broker fetch succeeded; console returned 200 from h2). - Deploy to dev (C-5, C-9) — merge → `jaah-deploy.yml` develop path — needs nothing beyond the worktree. - Container tests (D18) — docker + qemu binfmt on the runner's node (mem-26702) — needs nothing beyond the worktree host. - Gates — `./dc check quick` / `full` — needs nothing beyond the worktree. Out of scope: Do NOT touch / do NOT do — - Do NOT add a `gha_runners` capability restriction (O5). - Do NOT create or choose a GitHub repo without the operator's answer (outward-facing). - Do NOT change the package helpers' contract (Amazon Linux child) beyond adding names it needs. - Epic-wide negative constraints (PRD §5, verbatim): - MUST NOT make MicroVM work on arm64 Linux, or on any newly supported release. It is reported unavailable (C-7) unless it already works there. - MUST NOT change the cloud-launched EC2 image (`apps/api/app/aws/ec2.py` `UBUNTU_RELEASE` / `_UBUNTU_IMAGE_NAME`) or add an OS picker to the EC2 create flow. The stale comment at `ec2.py:1111` is the one allowed edit there (C-6). - MUST NOT change the macOS or Windows installers, bundles or their install commands (`node_bootstrap.py` macOS and Windows sections, `packaging/macos/`, `packaging/windows/`). - MUST NOT replace, relink or upgrade the distro's system `python3` (`/usr/bin/python3`). - MUST NOT add an OS or arch argument, flag or variant to the console's install command. - MUST NOT support Ubuntu 20.04, Debian, RHEL, Amazon Linux 2, or architectures other than x86_64 and arm64 as **supported**. They get only C-8's warn-and-try. - MUST NOT gate the support behind a feature flag, plan feature or setting. - MUST NOT bump unrelated pins in `packaging/platform-pins.toml`, `packaging/microvm-pins.toml` or `packaging/runner-cli-locks/` beyond what a supported cell needs to install. Done means: - Unit tests for both table shapes (per-arch tarball pin + sha256; every `HOST_PACKAGES`/Playwright entry has apt and dnf names or a pinned upstream binary). - Container oracle: `amazonlinux:2023` and `ubuntu:22.04`, both arches, resolve every host package — cite output. - Post-merge on real dev EC2: a GHA runner registers and runs one job (incl. a browser job, R10) on Ubuntu 24.04 arm64 (installable today); the AL2023 arm64 and x64 job cells are run by the sweep child, because AL nodes enrol only through the bootstrap child's dnf branch — or, if the operator declined the target repo, those cells are recorded **unproven against O5** (deferred — no target repo), never done. - `./dc check quick` green; merge lane `./dc check full` green; Jaah Deploy to dev succeeded.

GHA runners now install on arm64 and Amazon Linux: per-arch runner tarball pins, apt+dnf package tables, and dnf-automatic for patching. Container oracle passes on AL2023 and Ubuntu 22.04, both arches. PR #7308 merged and dev deploy is green. EC2 job cells unproven against O5: the operator declined a target repo. Memory: used mem-30079.