Isolate backend Docker jobs on ephemeral runners (#322)

## Summary
- Run Docker-producing PHP, Edge Broker, and Edge Gateway jobs on
ephemeral Ubuntu workspaces for both PR and push events.
- Keep the non-Docker Edge Agent and Release Manager gate on the trusted
backend pool.
- Preserve the explicit system-socket selection and fail-closed Docker
access check.

## Root cause
Exact-master run 29942825210 got past Docker access, then later jobs
failed during checkout because an earlier container left
`services/php/logs/error.log` root-owned in the reused self-hosted
workspace. This is workspace contamination, not a product-test failure.
The shallow frontend repair pattern would miss the depth-4 file and
would accumulate undeletable trash directories.

## Verification
- Workflow YAML parse passed.
- `git diff --check` passed.
- PR CI must be green; after merge, exact-master Required CI and the
non-skipped Release Manager gate are mandatory.

.github/workflows/tests.yml

@@ -19,8 +19,8 @@ concurrency:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    # Pull requests are untrusted and use ephemeral runners; trusted pushes use the local pool.
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    # Docker jobs use disposable workspaces so root-owned container artifacts cannot poison later checkouts.
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -115,7 +115,7 @@ jobs:
 
   edge-broker:
     name: Edge Broker (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
 
@@ -159,7 +159,7 @@ jobs:
 
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml