Doctrine + infra: discriminating runner labels for ARC pool (A.5.20)

[Krypt0nBull3t]

Context

Surfaced during UBLGenie's CI migration PR (Back-to-code/ublgenie-app#165) — first territory to adopt Back-to-code/actions/setup-{php,node}@v1. PR review flagged that bare runs-on: self-hosted (Rule 1 in this repo's README) leaves the ARC pool open to any rogue runner registered with the self-hosted label under ISO 27001 A.5.20.

Deferred from #165 because the fix is war-room-wide, not per-territory: workflow-side label changes can't land until the ARC pool re-registers with matching labels — otherwise jobs queue indefinitely.

Required coordination (single window)

1. Doctrine update (this repo) — README Rule 1 evolves from runs-on: self-hosted to runs-on: [self-hosted, <territory>, linux-x64]. Document the labelled-pool pattern and per-territory naming.
2. Infra re-registration — re-register the ARC RunnerScaleSet / RunnerDeployment manifest with new labels (typically --labels on the runner spec). Owner: infra.
3. Per-territory workflow change — each consuming repo replaces runs-on: self-hosted with the labelled-array form. Currently in scope: ublgenie-app (#165 already merged on bare label), daymate/api (not yet adopted).

Acceptance

• README Rule 1 updated with labelled-pool pattern + per-territory naming convention
• ARC pool re-registered (infra confirms via gh api /repos/<org>/<repo>/actions/runners showing app-specific labels)
• ublgenie-app/.github/workflows/pr-checks.yml migrated to labelled form
• Complete before daymate adopts Back-to-code/actions to prevent inheriting bare-label posture

References

• PR thread: Back-to-code/ublgenie-app#165 (Goosterhof's CHANGES_REQUESTED Blocker setup-node: cache strategy fragile on workspace nesting + broken postinstalls #2 + APPROVE remaining-ask)
• ISO 27001 A.5.20 (supplier supply chain — controlled-supplier posture)
• UBLGenie (UBL-0028) SUMMARY.md "Out-of-scope follow-up: discriminating runner labels"

[YouriLieverdink]

Wat is nu precies de vraag? Ik vind deze AI opmerkingen allemaal boem onduidelijk @Krypt0nBull3t haha