CI: rename runner label ubuntu-latest → py3.12-node22

The label now explicitly declares the dependency versions it provides
rather than using the opaque ubuntu-latest alias. All runs-on fields
in ci.yml updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -39,7 +39,7 @@ env:
 jobs:
   typecheck:
     name: TypeScript typecheck
-    runs-on: ubuntu-latest
+    runs-on: py3.12-node22
     steps:
       - uses: actions/checkout@v6
 
@@ -59,7 +59,7 @@ jobs:
 
   lint:
     name: Python lint
-    runs-on: ubuntu-latest
+    runs-on: py3.12-node22
     steps:
       - uses: actions/checkout@v6
 
@@ -71,7 +71,7 @@ jobs:
 
   test:
     name: Python tests
-    runs-on: ubuntu-latest
+    runs-on: py3.12-node22
     steps:
       - uses: actions/checkout@v6
 
@@ -100,7 +100,7 @@ jobs:
     needs: [typecheck, lint, test]
     # Only build on branch/tag pushes — not on pull requests
     if: github.event_name == 'push'
-    runs-on: ubuntu-latest
+    runs-on: py3.12-node22
     steps:
       - uses: actions/checkout@v6