docs(memory): record the CI runner contract

[rldyourmnd]

Follow-up to the explicit-runner change: the Serena CI-01-ACTIONS memory
recorded only that "CI memories record which checks prove repository integrity",
which is true of every repository and therefore says nothing about this one.

It now carries the constraint the workflows actually depend on:

• every caller of a ci-workflows reusable that exposes runner passes
  ubuntu-latest explicitly, because this repository is public and the
  reusable default is a property of the pinned commit — on current
  ci-workflows main, 39 of 46 reusables default to the estate self-hosted
  amsterdam label;
• at the pin in use the default is still ubuntu-latest, so the explicit value
  is a no-op today and becomes load-bearing at the next bump;
• the pin-bump review step: diff inputs.runner.default across the two commits;
• the library enforces this for its own self-calls and published examples, but
  nothing extends it to external consumers, which is why the rule also lives in
  AGENTS.md and .claude/CLAUDE.md here.

Memory metadata and evidence commit refreshed. No code or workflow change.