Compile release binaries on the self-hosted runner in Russia

The Russian software registry filing declares where the source is stored and
where the product is compiled, so release binaries have to come off a machine
that matches that declaration. The release build matrix (Win32, x64, ARM64)
moves to the self-hosted runner (labels: self-hosted, windows, adler);
CI_build, CodeQL, dependency review, and the compatibility smoke stay on
GitHub-hosted runners.

The workflow only starts on tag pushes and manual dispatch, so no pull request
from a fork can execute code on that machine.

Adds a manual Runner self-test workflow that builds every platform on the
runner without publishing anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: krotname

.github/workflows/release.yml

@@ -51,8 +51,12 @@ jobs:
 
   build:
     needs: version
-    runs-on: windows-2022
-    timeout-minutes: 30
+    # Release binaries are compiled on the self-hosted runner in Russia, which is what the
+    # Russian software registry filing declares as the compilation host. Pull request and CI
+    # checks stay on GitHub-hosted runners; this workflow only starts on tag pushes and manual
+    # dispatch, so no fork code can reach the machine.
+    runs-on: [self-hosted, windows, adler]
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:

.github/workflows/runner-selftest.yml

@@ -0,0 +1,50 @@
+name: Runner self-test
+
+# Manual check that the self-hosted release runner can still build the plugin for every
+# platform. It never publishes anything: no release, no artifacts, no attestation.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  selftest:
+    runs-on: [self-hosted, windows, adler]
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [Win32, x64, ARM64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Add msbuild to PATH
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
+
+      - name: Ensure ARM64 C++ build tools
+        if: matrix.platform == 'ARM64'
+        shell: pwsh
+        run: .\scripts\Ensure-VsArm64Tools.ps1
+
+      - name: Report runner environment
+        shell: pwsh
+        run: |
+          "runner: $env:RUNNER_NAME"
+          "host: $env:COMPUTERNAME"
+          "os: " + (Get-CimInstance Win32_OperatingSystem).Caption
+          "cpu: " + (Get-CimInstance Win32_Processor | Select-Object -First 1 -ExpandProperty Name)
+          "ram_gb: " + [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB)
+          "free_disk_gb: " + [math]::Round((Get-PSDrive C).Free / 1GB)
+          msbuild -version
+
+      - name: Build package
+        run: msbuild Package.proj /m /t:Package /p:Configuration=Release /p:Platform="${{ matrix.platform }}"
+
+      - name: Report produced artifacts
+        shell: pwsh
+        run: Get-ChildItem build -File -Filter *.zip | ForEach-Object { "{0} {1} bytes" -f $_.Name, $_.Length }