ci: a runner label names the platform, not the org

hanzo-build-linux-amd64, lux-build-linux-amd64, zoo-build-linux-amd64 and
every other org-prefixed spelling all meant the same machine. Which org a
job belongs to does not change which host can build it, so the org bought
one pool name per org per arch and each could go stale on its own -- the
evo host alone answered to fourteen names for one label.

One vocabulary now: linux-amd64, linux-arm64, macos-arm64, win-amd64. The
generic labels every plain workflow uses (ubuntu-latest, self-hosted) are
untouched, so naive CI keeps working.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/ci.yml

@@ -32,7 +32,7 @@ concurrency:
 jobs:
   go-test:
     name: Go reference impl + KAT + Class N1 interop
-    runs-on: [lux-build-linux-amd64]
+    runs-on: [linux-amd64]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -55,7 +55,7 @@ jobs:
 
   spec-pdf:
     name: spec PDF build
-    runs-on: [lux-build-linux-amd64]
+    runs-on: [linux-amd64]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -82,7 +82,7 @@ jobs:
 
   high-assurance:
     name: Jasmin type-check + EasyCrypt admit budget + EC compile
-    runs-on: [lux-build-linux-amd64]
+    runs-on: [linux-amd64]
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
@@ -151,7 +151,7 @@ jobs:
     # mode (no --infer) on every push. A regression here is CI red.
     name: jasmin-ct on threshold layer (blocking)
     needs: high-assurance
-    runs-on: [lux-build-linux-amd64]
+    runs-on: [linux-amd64]
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -192,7 +192,7 @@ jobs:
     # `continue-on-error` to flip this job to blocking.
     name: jasmin-ct on libjade ML-DSA-65 sign (tracked allowed-failure, #2)
     needs: high-assurance
-    runs-on: [lux-build-linux-amd64]
+    runs-on: [linux-amd64]
     timeout-minutes: 60
     continue-on-error: true
     steps: