ci: standby archive base ref; runbook — dependabot exception, clean bootstrap, variable trust model

- serial-linux-selfhosted now fetches depth 2 and passes
  DSH_ARCHIVE_BASE_REF=github.event.before, running the same
  frozen-archive comparison as serial-linux instead of diffing the
  new manifest against itself.
- Runbook (both languages): documents the deliberate dependabot
  exception (queued-on-hosted during failover is expected, not a
  failed switch); corrects the emergency-capacity bootstrap to
  exclude .runner/.credentials when cloning a runner directory; and
  replaces the 'admin-only' variable claim with the accurate
  trust-model statement — repository variables are writer-manageable,
  which in this private fork-disabled repo with an all-workflows
  runner group is routing among members, not an escalation.
Static gate green locally: 32 passed, 0 failed.

.github/workflows/ci.yml

@@ -423,7 +423,12 @@ jobs:
     name: serial / linux (self-hosted standby)
     runs-on: [self-hosted, linux, x64, vm-backup]
     steps:
+      # fetch-depth 2 + DSH_ARCHIVE_BASE_REF below: same frozen-archive
+      # comparison as serial-linux — without the prior commit the archive
+      # verifier defaults to HEAD and compares the new manifest with itself.
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - uses: actions/setup-node@v6
         with:
@@ -440,6 +445,7 @@ jobs:
 
       - name: Run complete unsharded primary Node CI serially
         env:
+          DSH_ARCHIVE_BASE_REF: ${{ github.event.before }}
           DSH_COVERAGE_MAX_WORKERS: '1'
           DSH_E2E_MAX_WORKERS: '1'
           DSH_ESLINT_CACHE: '1'