[codex] Make package workflow explicitly hosted

[Jesssullivan]

What changed

• switched the shared package workflow call to the V2 branch in ci-templates
• declared runner_mode: hosted
• declared workspace_mode: isolated
• declared publish_mode: same_runner

Why

tinyvectors does not currently expose repo-owned runner variables, so it should not be counted as a runner-dogfood repo just because it shares the template. This patch removes that ambiguity.

Impact

• the repo remains a template consumer, but now explicitly as a hosted consumer
• adoption reporting can stop overcounting this repo as self-hosted usage
• the same V2 workflow still applies, which keeps the contract surface consistent across the rollout

Validation

• git diff --check
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); YAML.load_file(".github/workflows/publish.yml")'

Notes

• promotion to self-hosted should happen only after real runner labels exist in repo settings or workflow inputs

[greptile-apps]

Greptile Summary

This PR makes runner configuration explicit in both workflow files by adding runner_mode: hosted, workspace_mode: isolated, and publish_mode: same_runner, and pins the reusable workflow call to a specific commit SHA (0e13cc4e50b191f48191f08b3db081307d3447ce) instead of a mutable branch ref. The changes are consistent across ci.yml and publish.yml, correctly preserve the dry_run: true/false distinction, and do not alter any functional build or test logic.

Confidence Score: 5/5

Safe to merge — purely declarative configuration change with no functional logic altered.

Both files have no P0 or P1 findings. The changes correctly and consistently add three explicit mode parameters and pin the reusable workflow to an immutable SHA, which actually improves supply-chain safety compared to a mutable branch ref.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds explicit runner_mode: hosted, workspace_mode: isolated, publish_mode: same_runner, and pins the reusable workflow to a specific commit SHA; dry_run remains true.
.github/workflows/publish.yml	Same parameter additions and SHA pin as ci.yml; dry_run is correctly set to false for the real publish path; no concurrency block (pre-existing gap, not introduced here).

_{Reviews (1): Last reviewed commit: "ci: pin shared workflow to merged contra..." | Re-trigger Greptile}