Self-hosted runner pool with a mounted git mirror + warm image store — the last per-job costs (checkout, once-per-digest pull) go to zero #2926

Maintainer directives, 2026-09-01, during the module-CI overhaul: "can we mount a drive where git is checked out" … "keep a drive with checked out git mounted => just update to proper release" … "in worktree" … "delete worktree at end".

GitHub-hosted runners cannot mount persistent drives, so #2924/#2925 approximated the shape with per-digest blob caches (image tarball, tester app, packer) — that removes the per-JOB registry trips. What remains is the once-per-digest fill and the ~6–10s checkout per job. The full shape is a self-hosted pool:

• ARC (actions-runner-controller) on the existing AKS cluster, dedicated node pool so CI cannot starve the portal;
• a persistent volume carrying a bare git mirror per repo; each job runs git -C mirror fetch (delta-only, ~1s) then git worktree add <job-dir> <release-ref> — and deletes the worktree at job end (the mirror stays);
• warm docker layer store on the node (host containerd + a pre-pull DaemonSet for the current portal/tester digests) so even the once-per-digest pull disappears;
• runner labels so the module lanes opt in per repo; hosted runners remain the fallback.

Also agreed for the lane, tracked with the shape doc (Doc/Architecture/ModuleBuildArchitecture): after the global build, run tests — one build job builds the whole graph in one Roslyn workspace, test jobs consume its artifacts.

Prereqs to respect: the AKS cluster is private (az aks command invoke only), env config lives in Systemorph/Memex, and the deployment program routes cluster changes through the operator.