[beengud]

Summary

• Adds .github/workflows/integration.yml — a self-hosted-runner workflow that runs the end-to-end integration test (crates/scribe/tests/transcribe.rs) against the real ffmpeg + whisper.cpp pipeline. Triggers ONLY on push to main and workflow_dispatch; never pull_request, because raibid-labs/scribe is a public repo and fork PRs on a self-hosted runner would let attackers run arbitrary code on the runner host.
• Adds docs/07-self-hosted-ci.md — security model, runner registration (UI + gh api flows), required labels, host package requirements, hardening guidance (dedicated gh-runner user, isolated work dir, systemd unit, deny-incoming firewall), and a clean removal procedure.
• Updates docs/00-index.md and the README "Documentation" section to reference the new doc.

No source under crates/scribe/src/ is touched. The runner itself is not registered as part of this PR — that's a manual operational step the maintainer performs after merge.

Security model (recap)

• New workflow triggers ONLY on push to main (post-merge, code already reviewed) and workflow_dispatch (manual, requires repo write access).
• No pull_request trigger. Adding one would expose the runner host to arbitrary code execution via fork PRs.
• permissions: contents: read, persist-credentials: false, no caller-controlled inputs interpolated into shell strings.
• Existing ci.yml (fmt / clippy / test on ubuntu-latest) is unchanged and continues to handle PR validation; the integration test stays in skip mode there.

Validation performed

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/integration.yml'))" — parses, triggers are exactly [push, workflow_dispatch], runs-on is [self-hosted, Linux, ARM64, scribe-integration].
• cargo fmt --all -- --check — clean.
• cargo clippy --all-targets --all-features -- -D warnings — clean.
• cargo test --all — 6 integration tests + unit tests pass locally (the integration test runs for real on this host, which has the toolchain installed; on a stock ubuntu-latest it would still skip cleanly).

Test plan

• Reviewer eyeballs .github/workflows/integration.yml and confirms there is no pull_request trigger.
• Reviewer confirms permissions: is contents: read only.
• Reviewer confirms actions/checkout@v4 runs without a caller-controlled ref:.
• After merge, maintainer registers a runner on the DGX Spark per docs/07-self-hosted-ci.md with labels self-hosted, Linux, ARM64, scribe-integration.
• First post-merge push to main lands on the runner; the "Run end-to-end integration test" step exercises the real pipeline and passes (no SKIP transcribe_jfk_end_to_end: line in the log).
• If anything goes wrong, workflow_dispatch is used to re-run after fixing the runner host.

Closes #18

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com