ci: the runners go back to ubuntu-24.04 - the 26.04 label fails the pinned actionlint's list, and the snapshot under it (kernel 7.0.0-1012-azure) breaks the compose and the qemu laps regardless

Three runs measured it: the compose's bwrap cannot open the base's
0000 gshadow on the 7.0 kernels - the sysctl knob is gone on the
newest runners and wrote-nothing-that-helped on the others, and an
explicit apparmor=unconfined on the compose did not save it either;
and linux-modules-extra-7.0.0-1012-azure is unpublished in the
archive, which kills every qemu lap at ground prep no matter what
the lists say. The 24.04 pool is the ground the last-green composes
and laps ran on, its knob is the one the install-boot prelude knows
how to clear, and its modules-extra exists. The soname contract that
motivated the 26.04 pin no longer touches the runner: the action
builds libav 8 from source.

Author: Letdown2491

.github/workflows/ci.yml

@@ -66,7 +66,7 @@ jobs:
   # start ahead of the slow jobs; it does not gate `test`, which is what
   # a pull request waits on.
   when:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     # a guard job that takes 3s
     timeout-minutes: 5
     outputs:
@@ -104,7 +104,7 @@ jobs:
   # image that keeps kuma's floor (greenboot, the lint, the baked
   # declaration, a greeter check on every desktop).
   test:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     # cargo with a warm cache runs in under a minute
     timeout-minutes: 20
     steps:
@@ -161,7 +161,7 @@ jobs:
     # the action pins carry: a moving main silently decides what this
     # gate means. Dependabot cannot see a raw git clone; the pin is
     # bumped by hand, and the diff is the review.
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -241,7 +241,7 @@ jobs:
   # covered without touching this file.
   #
   image:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     # the real exposure here: it normally takes 12 to 14 minutes, and the default is six hours
     timeout-minutes: 45
     # Skipped on both scheduled runs: this builds a real image with
@@ -298,7 +298,7 @@ jobs:
   # image stage, so the install stage rides along for the cost of the
   # install itself rather than a second build.
   boot:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: when
     if: >-
       github.event_name != 'pull_request' &&
@@ -380,7 +380,7 @@ jobs:
   # units with no coverage here for exactly that reason. It tests the
   # tree, so it runs when the tree changes.
   install:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: when
     if: >-
       github.event_name != 'pull_request' &&
@@ -436,7 +436,7 @@ jobs:
   # push it keeps where the promise lives: this is the only automated
   # check that a hibernated machine comes back.
   hibernate:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: when
     if: >-
       github.event_name == 'workflow_dispatch' ||
@@ -479,7 +479,7 @@ jobs:
   # nobody takes twice: you install once, and a stranger installs once,
   # and if a restore does not work then nothing else here mattered.
   dead-disk:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: when
     if: >-
       github.event_name != 'pull_request' &&
@@ -528,7 +528,7 @@ jobs:
   # here, where they cost a red run instead of a release; release.yml
   # switched attaching on once this had gone green on a hosted runner.
   iso:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs: when
     if: >-
       github.event_name != 'pull_request' &&
@@ -598,7 +598,7 @@ jobs:
   # losing its maintainer is worth hearing about on a Monday, and is not
   # worth blocking a push over.
   audit:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     # 17s in practice
     timeout-minutes: 10
     steps:

.github/workflows/publish.yml

@@ -60,7 +60,7 @@ jobs:
   # `:niri-$version`) are computed here but pushed nowhere; only the
   # staging tag leaves this job.
   publish:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     outputs:
       repo: ${{ steps.ref.outputs.repo }}
       example: ${{ steps.guard.outputs.example }}
@@ -288,7 +288,7 @@ jobs:
   # own command run against the tags the stranger uses.
   promote:
     needs: [publish, validate]
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/published.yml

@@ -70,7 +70,7 @@ permissions:
 
 jobs:
   install-and-boot:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -102,7 +102,7 @@ jobs:
   # property of the install, not of the image, so this needs no compose
   # and adds no build time.
   encrypted-boot:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -158,7 +158,7 @@ jobs:
   # the `policy.json` case. If that needs testing again, dispatch this
   # with from_image set rather than adding a second job.
   cross-version:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/release.yml

@@ -40,7 +40,7 @@ env:
 
 jobs:
   release:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     env:
       # Whether a release carries the live ISO, decided in one place.
       #