fix(ci): bind fleet shadow to qualified hosts

[alphastorm]

Change

• make unknown fleet sites resolve to an unroutable label instead of SF
• validate exact target, one-time routing label, site-bound dispatch ID, SF/NYC runner name, and Docker-socket absence before checkout
• add executable healthy NYC/SF and denial fixtures using a real Unix-domain socket
• keep LRHE developmentEligible: false and no-promotion status unchanged

Local proof

• actionlint passed
• focused workflow contract: 9 passed
• full LRHE suite: 433 passed
• Ruff check and format passed

Automatic push and pull-request execution remains GitHub-hosted.