Build on the GitHub runner pool

a802f619 reached the forge mirror and started no build: the caller under
.hanzo/workflows has no runner left. GitHub is canonical and its
linux-amd64 jobs run on the JIT runners in AWS (ns hanzo-ci).

Claude-Session: https://claude.ai/code/session_01TUxvfuta1Z44KVNYuAz71F

.github/workflows/cicd.yml

@@ -0,0 +1,14 @@
+# Canonical caller — every knob lives in /hanzo.yml, none here.
+# github.com is canonical and its linux-amd64 jobs run on the JIT runners in
+# AWS (ns hanzo-ci); the image is built by the build door.
+name: CI/CD
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+jobs:
+  cicd:
+    uses: hanzoai/ci/.github/workflows/build.yml@v2
+    secrets: inherit

.hanzo/workflows/cicd.yml

@@ -1,15 +0,0 @@
-# Canonical caller — every knob lives in /hanzo.yml, none here.
-# Runs on the git-runner fleet at git.hanzo.ai, the only pool serving these
-# labels. github.com resolves only .github/workflows and has no runner for
-# them, so a caller placed there is a gate that cannot be scheduled.
-name: CI/CD
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  pull_request:
-  workflow_dispatch:
-jobs:
-  cicd:
-    uses: hanzoai/ci/.github/workflows/build.yml@v1
-    secrets: inherit

README.md

@@ -1,7 +1,7 @@
-> **`hanzoai/captable` builds `ghcr.io/hanzoai/captable`**: git.hanzo.ai
-> mirrors it and runs `.hanzo/workflows/cicd.yml` against `hanzo.yml`. It is also
-> the Go module path the cloud binary imports. `hanzo-apps/captable` holds the
-> same commits and has no forge build, so one repository publishes the image.
+> **`hanzoai/captable` builds `ghcr.io/hanzoai/captable`**: GitHub runs
+> `.github/workflows/cicd.yml` against `hanzo.yml` on every push to main. It is
+> also the Go module path the cloud binary imports. `hanzo-apps/captable` holds
+> the same commits and has no build, so one repository publishes the image.
 > Push every commit to both.
 
 <p align="center"><img src=".github/hero.svg" alt="captable" width="880"></p>