branderson
702871732e
`pull_request` is gone; only `pull_request_target` remains, so the workflow is read from the base branch and a pull request cannot choose which runner its jobs land on. The two runner-env jobs drop their explicit `ref:` along with it. They assert on the runner rather than on the change, so their assertions should come from main, where a branch can neither weaken nor delete them.