Use hosted compilation for stable releases

.github/workflows/build-release-candidate.yml

@@ -76,10 +76,11 @@ permissions:
 jobs:
   compile-release-payload:
     name: Compile Exact-SHA Release Payload
-    # SignPath Foundation validates every job leading up to an OSS signing
-    # request. Keep stable signed candidates entirely on GitHub-hosted runners;
-    # prerelease and explicitly unsigned candidates retain the fast PVE lane.
-    runs-on: ${{ inputs.require_windows_signing && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","pulse-pve-compile"]') }}
+    # Stable exact-SHA candidates favor the reproducible hosted lane. The PVE
+    # matrix remains fast for prereleases, but two stable rehearsals lost
+    # different compiler processes under runner resource pressure. Hosted
+    # provenance is also mandatory when a stable candidate reaches SignPath.
+    runs-on: ${{ !contains(inputs.version, '-') && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","pulse-pve-compile"]') }}
     timeout-minutes: 20
     steps:
       - name: Checkout repository

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -1626,10 +1626,13 @@ exact uploaded artifact through the GitHub Actions API, and GitHub validates
 that nested permission even when a prerelease skips Authenticode signing.
 SignPath Foundation also requires every job leading up to an open-source
 signing request to execute on GitHub-hosted runners. Stable signed candidates
-therefore route release preparation, exact-SHA compilation, the parallel
-frontend bundle, and backend qualification through GitHub-hosted runners until
-the signing request is on record. Prerelease and explicitly unsigned candidates
-retain the credential-free PVE acceleration path; post-signing container
+therefore route release preparation, the parallel frontend bundle, and backend
+qualification through GitHub-hosted runners until the signing request is on
+record. All stable candidates route exact-SHA compilation through the hosted
+lane: rehearsals `32631653966` and `32635525554` lost different matrix compiler
+processes on the PVE runner without compiler diagnostics after substantial
+progress, while the same targets build independently. Prereleases retain the
+credential-free PVE compilation path for speed; post-signing container
 qualification may also use PVE because it cannot affect the submitted Windows
 artifact.
 

scripts/installtests/build_release_assets_test.go

@@ -2360,7 +2360,7 @@ func TestReleasePipelinePromotesOneImmutableCandidate(t *testing.T) {
 	}
 
 	for _, needle := range []string{
-		`inputs.require_windows_signing && 'ubuntu-24.04'`,
+		`!contains(inputs.version, '-') && 'ubuntu-24.04'`,
 		"pulse-pve-compile",
 		`./scripts/build-release-binaries.sh "${{ inputs.version }}"`,
 		`release-compiled-${{ github.sha }}-${{ inputs.version }}`,