Run cPanel recovery and deploy from stable runner (#189)

Use the stable self-hosted runner for cPanel API calls and install lftp job-locally without sudo.

.github/workflows/cpanel-root-restore.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   audit-or-restore:
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, X64, default]
     timeout-minutes: 10
     environment:
       name: frontend-production

.github/workflows/release.yml

@@ -160,7 +160,7 @@ jobs:
   deploy-frontend-production:
     needs: build-release
     if: needs.build-release.outputs.current == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, X64, default]
     timeout-minutes: 90
     environment:
       name: frontend-production
@@ -198,10 +198,20 @@ jobs:
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
-      - name: Install secure FTP client
+      - name: Install secure FTP client without system changes
         run: |
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends lftp
+          if command -v lftp >/dev/null 2>&1; then
+            exit 0
+          fi
+
+          package_root="$RUNNER_TEMP/lftp-package"
+          mkdir -p "$package_root"
+          (
+            cd "$package_root"
+            apt-get download lftp
+            dpkg-deb --extract ./lftp_*.deb root
+          )
+          echo "$package_root/root/usr/bin" >> "$GITHUB_PATH"
 
       - name: Install Playwright Chromium
         run: node scripts/install-playwright-browsers.mjs chromium