fix: route PR jobs to ephemeral runners and clean isolated Docker auth

[gilescope]

Motivation

• Prevent credential exposure from pull_request jobs that execute checked-out repository code on persistent self-hosted runners by avoiding sourcing untrusted .envrc/Earthly on those hosts.
• Remove persistent Docker auth residue that could be read by later jobs on shared/persistent self-hosted runner HOME directories.

Description

• Route jobs that run on pull_request to ephemeral GitHub-hosted runners by making runs-on conditional (ubuntu-latest for PRs, self-hosted for non-PR events) across the main CI and test workflows.
• Ensure Docker auth is isolated per-runner by creating an isolated $RUNNER_TEMP/.docker directory and exporting DOCKER_CONFIG=$RUNNER_TEMP/.docker where registry logins occur (added to the test workflow and harmonized with existing isolation steps).
• Add explicit cleanup steps that remove the isolated Docker auth directory (rm -rf "$DOCKER_CONFIG") after registry use in affected jobs to avoid leaving credentials on persistent storage.
• Apply the isolation+cleanup pattern in multiple jobs that previously used self-hosted runners or performed registry logins, and preserve existing behavior for trusted, non-PR runs.

Testing

• Verified both modified workflow files parse successfully as YAML using a Ruby YAML loader (.github/workflows/continuous-integration.yml and .github/workflows/continuous-integration-test.yml).
• Ran git diff --check and a local syntax/consistency sweep to ensure no obvious formatting errors were introduced.
• Attempted to run actionlint but it could not complete in this environment due to a Go proxy HTTP 403, so static linting with actionlint was not available here.

---

Codex Task