[simonostendorf]

What

• Every job moves from blacksmith-2vcpu-ubuntu-2404 to ubuntu-latest.
• useblacksmith/setup-docker-builder becomes docker/setup-buildx-action, and
  useblacksmith/build-push-action becomes docker/build-push-action, both pinned by digest.
• The runs-on-runner input is deleted from every reusable workflow call rather than set to
  ubuntu-latest, because that is already the input's default in ostendorf-cloud/workflows.
• Comments that explained a Blacksmith-specific choice are rewritten or removed, so none
  describes behaviour that no longer exists.

Why

• This repository is public. GitHub-hosted runners are free and unlimited on public
  repositories, while Blacksmith bills per minute, so the spend bought nothing.
• Measured on 2026-11-14: nine repositories in this organisation still ran on Blacksmith, seven
  of them already public.
• Both GitHub and Blacksmith bill per job rounded up to a full minute, and these suites are
  wide and short, so the per-job rounding dominated the bill.

Verification

• task lint:actions passes.
• task lint:yaml passes.
• grep -ri blacksmith .github/workflows/ AGENTS.md prints nothing.
• The two action digests match the ones already pinned in
  ostendorf-cloud/release-me/.github/workflows/publish.yaml. Neither was invented.
• Every with: key passed to the docker actions was checked against action.yml at the pinned
  commit. load and file were confirmed to exist there rather than assumed.

Risk

• The swap is like for like. No platforms: key is added, so an image that built single-arch
  amd64 still does.
• docker/build-push-action is upstream of the Blacksmith fork, so the inputs carry over, but
  the first run on each workflow is where that is proven rather than reasoned about.
• Blacksmith's runner cache is gone. Builds may be slower until GitHub's own caching warms,
  which costs time and no money on a public repository.
• AGENTS.md carried a now-false deviation stating this repository is private and therefore
  bills its minutes. Removed here. Other stale deviations about CodeQL and licensing remain and
  need a separate pass.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}