ci: document why this public repo stays on hosted runners

[goastler]

This repo already runs its only workflow on ubuntu-latest and never referenced vars.GH_RUNNER, so this is a comment-only change — it records the invariant so nobody later routes it through the self-hosted fleet.

Why

• The repo is public. Routing jobs through vars.GH_RUNNER would let a fork PR execute arbitrary contributor code on hardware we own, and persist there to poison later trusted jobs.
• There is no cost argument against staying hosted: standard GitHub-hosted runners are free and unlimited on public repos, macOS and Windows included. Only larger runners are billed, on public and private repos alike.

Matches the existing precedent in prosopo/captcha android-webview.yml, and the sweep in prosopo/captcha#3056.

Ref: https://docs.github.com/en/billing/reference/actions-runner-pricing