Implement CI Bifurcation (Split Hosted vs Self-Hosted)

[Coldaine]

Start from branch fix/remove-xvfb (PR #328).

Implement the CI split described in docs/dev/CI/architecture.md and the "Proposal B" discussion.

Goal:
Optimize CI by offloading stateless tasks to GitHub-hosted runners and reserving the self-hosted runner for build caching and hardware tests.

Tasks:

1. Split unit_tests_hosted job:
   • Create separate jobs for lint (fmt + clippy), security (audit + deny), and docs.
   • These jobs should run on ubuntu-latest.
   • They should NOT depend on the self-hosted runner.
2. Configure Self-Hosted Job:
   • Keep the main build and test (hardware dependent) on self-hosted.
   • Ensure moonshine_check runs on self-hosted.
3. Workflow Dependencies:
   • Ensure the self-hosted job doesn't wait for the hosted jobs unless necessary (fail fast is good, but parallelism is better).

Reference:
See docs/dev/CI/architecture.md for the architectural vision.

[google-labs-jules]

Jules is on it. When finished, you will see another comment and be able to review a PR.

[google-labs-jules]

Ready for a review! A PR has been created.