Promote graceful scale-in (actions-runner) to global modules

[akuzminsky]

Follow-up to #265 (development) and #266 (sandbox).

Scope

Copy the graceful scale-in changes from environments/sandbox/modules/profile/github_runner/ into the top-level modules/profile/github_runner/ (global). Bump terraform-aws-actions-runner module version in all remaining environments so the deregistration_hookname fact + new IAM are available everywhere.

Files to promote:

• files/github_runner/gha_prerun.sh
• files/github_runner/gha-lifecycle-heartbeater.sh
• files/github_runner/gha-lifecycle-heartbeater.timer
• files/github_runner/gha-on-runner-exit.sh
• manifests/github_runner/register.pp
• manifests/github_runner/service.pp
• templates/github_runner/actions-runner.service.erb
• templates/github_runner/gha-lifecycle-heartbeater.service.erb
• templates/github_runner/start-actions-runner.sh.erb

Pre-conditions

• Promote graceful scale-in (actions-runner) to sandbox #266 merged and deployed to sandbox.
• ~1 week of stable observation in sandbox: no ValidationError on SetInstanceProtection, no stuck Terminating:Wait instances, no prerun failures.
• terraform-aws-actions-runner Part 1 release applied to all production AWS accounts.

Verification after promotion

• Full success criteria in .claude/plans/actions-runner-scale-in-race.md verified across production runners.

See .claude/plans/actions-runner-scale-in-race.md §9.