ci(release): use dedicated runners for release publishing

[aidandaly24]

Description

Complete the dedicated-runner migration after #2259.

• Change check-release and publish in release-publish.yml from ubuntu-latest to aws-release-4-core.
• Keep the push trigger, all release-PR guards, SHA pinning, permissions, publishing steps, and verification matrix unchanged. Release preparation already uses this runner.
• Update the README and migration TODO: publishing is allowlisted on refactor only. After this file lands on main, a runner-group administrator must add its main pin before changing the branch filter.

No package contents, application code, or test files are changed.

Related Issue

Closes #2267

Follow-up to #2259.

Documentation PR

Not applicable. The release documentation is updated in .github/workflows/README.md.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe): CI runner configuration

Testing

The refactor branch uses Bun rather than the default branch's separate npm unit/integration scripts.

• Parsed-workflow comparison against the base branch: the only semantic changes are the two runs-on values.
• 14 local release-gate cases, including the real release PR response, manual authors, incorrect bot IDs, forks, wrong branches/SHAs, unmerged PRs, pagination, and API failures.
• Actionlint validation with the custom runner label declared in a temporary local config.
• Formatting check for both changed files.
• bun run build
• bun run typecheck
• bun run lint:check
• bun test: 3,179 existing tests passed.

Runner-group approval was confirmed separately. No release workflow was dispatched, no npm package was published, and runner allocation was not exercised live during validation. All additional checks stayed outside the repository; no test scripts are included.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works (no new test files; local checks listed above)
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published (fix(release): preserve merge approvals and exclude native binaries from npm #2259 is merged; runner access is configured on refactor)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Changes requested

One substantive concern: the publish job in .github/workflows/release-publish.yml now runs on aws-release-4-core (line 50), but the comment on line 49 still says:

# npm provenance is only issued from GitHub-hosted runners.
runs-on: aws-release-4-core

That comment is the exact reason the publish job was previously kept on ubuntu-latest, and npm publish --provenance on line 105 depends on it. npm publish --provenance requires the runner to identify as github-hosted (via the RUNNER_ENVIRONMENT OIDC claim); Sigstore/Fulcio rejects tokens from self-hosted runners, and npm's docs are explicit that provenance requires a "cloud-hosted runner". If aws-release-4-core is a self-hosted runner group, this change will break provenance signing on the very next stable release.

Two options depending on what aws-release-4-core actually is:

1. If it's a GitHub-hosted larger runner (custom-labeled but still RUNNER_ENVIRONMENT=github-hosted): the change is fine, but please delete or rewrite the now-contradictory comment on line 49 so the next reader doesn't undo this by mistake. Ideally verify once with a dry run / rc publish that --provenance still succeeds.
2. If it's self-hosted (which the "dedicated runner group" / "allowlist" language in the README suggests): revert the publish job to runs-on: ubuntu-latest and leave only check-release and prepare on aws-release-4-core, then update the README paragraph accordingly (it currently claims all three jobs use the dedicated runner).

Everything else in the diff (moving check-release to aws-release-4-core, the README rewording, the updated TODO comment) looks fine.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.04%. Comparing base (bb1ed36) to head (f522270).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2268   +/-   ##
=========================================
  Coverage     97.04%   97.04%           
=========================================
  Files           566      566           
  Lines         39353    39353           
=========================================
  Hits          38190    38190           
  Misses         1163     1163           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[notgitika]

LGTM