ci: run shared workflows on the CodeBuild runner

[wangyb-A]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Issue Link, if available

No linked issue: follow-up to #751.

Description

Goal: run the shared-workflow jobs this repository calls (AI PR review, Slack notify, issue triage, stale-issue closer, OpenTelemetry conformance) on the CodeBuild-hosted runner in the Java testing account instead of the shared ubuntu-latest pool.

This completes the runner migration started in #751, which deliberately left these thin shells alone because their runs-on lives in the reusable workflows they call. Those now accept a runner input:

• aws/aws-durable-execution-ci — runs-on input on every workflow_call workflow (feat: add runs-on input to the shareable workflows aws-durable-execution-ci#67, not yet merged; see "Draft" below).
• aws/aws-durable-execution-conformance-tests — runs_on input on the OpenTelemetry orchestrator (ci: add runs_on input to the OTel orchestrator workflows aws-durable-execution-conformance-tests#132, merged as 3542852f).

What changed

Shell	Pin	Runner
ai-pr-review.yml, issue-triage.yml, notify.yml	d6b017da → d901b2f1	codebuild-github-actions-runner-${{ github.run_id }}-${{ github.run_attempt }}
stale-issue-closer.yml	d6b017da → d901b2f1	same
otel-conformance-tests.yml	43872f8d → 3542852f	same, via runs_on
ai-pr-review-address.yml, ai-pr-review-address-continuation.yml, ai-issue-implementation.yml	d6b017da → d901b2f1	unchanged (ubuntu-latest): their reusable workflow runs codex-issue-worker with timeout-minutes: 140, above the CodeBuild project's 60-minute job limit

Every shell except the three long-running AI shells passes the label unconditionally. All of them run from main's workflow definition (pull_request_target, issues, release, schedule) or are already gated to same-repository PRs (otel-conformance-tests), and the AI review checks out the pull request's base revision and reads the diff as data, so no fork-authored code executes on the runner.

The pin bumps carry the intervening upstream commits: 12 on aws-durable-execution-ci (the runs-on input, the model-user scripts no longer assuming a runner account, the model environment passed as an explicit env -i allowlist, one stale-issue-closer fix, dependabot bumps) and 1 on aws-durable-execution-conformance-tests.

Draft

The CI-repo pin points at the head of aws/aws-durable-execution-ci#67's branch. When #67 merges (squash), one follow-up commit replaces it with the merge SHA; nothing else changes. Do not merge while the pin is a branch commit.

Verification

• Every with: key each shell passes was checked against the callee's workflow_call inputs at the new pin; all resolve.
• otel-conformance-tests is pull_request-triggered and the orchestrator change is on main, so this PR's own OTel run exercises the CodeBuild path end to end.
• The other shells run from main's definition, so this PR cannot exercise them; the first event after merge is the live test. The reusable Codex review was run end to end on the CodeBuild runner from the [bugfix] remove unncessary policies #67 branch in aws-durable-execution-sdk-js run 37542509461, and the model-user scripts were exercised as root in run 37539805626.
• OTel job durations on recent PR runs are 3–8 minutes, under the project's 60-minute job limit.

Demo/Screenshots

N/A — CI configuration only.

Checklist

• I have filled out every section of the PR template
• I have thoroughly tested this change

Testing

Unit Tests

N/A — no SDK code changes.

Integration Tests

See Verification above: the OTel run on this PR exercises the CodeBuild path; the other shells are verified by the first event after merge.

Examples

N/A

[github-actions]

Codex AI review

No actionable findings found. Residual test risk remains because these event-driven workflow definitions and upgraded reusable-workflow pins receive no pre-merge end-to-end coverage.

Reviewed commit 42ffa65779e4b0c38112702b87efc261fa741cd8. Workflow run