[mrz1836]

What Changed

• Added RELEASE_RUNNER = `` (.github/env/00-core.env)
• NANCY_VERSION: v2.1.0 → v2.1.1 (.github/env/10-security.env)
• GO_COVERAGE_VERSION: v1.6.1 → v1.7.0 (.github/env/10-coverage.env)
• MAGE_X_GORELEASER_VERSION: v2.18.3 → v2.19.0 (.github/env/10-mage-x.env)
• MAGE_X_NANCY_VERSION: v2.1.0 → v2.1.1 (.github/env/10-mage-x.env)
• Added an optional release runner. setup resolves RELEASE_RUNNER, falling back to the primary runner when it is unset, and exposes it as a new release-runner output. fortress.yml passes it to the release workflow. Setup rejects Windows runners, and the config summary table now lists the release runner. The fortress-release.yml input description and workflows.md were updated to match.
• Narrowed the env-json output in the load-env action. It now contains only variables defined in the .github/env/*.env files, skipping 99-local.env in CI. Before, it dumped every exported uppercase variable from the runner environment.
• Extended the auto-merge trigger so that a Dependabot PR whose base branch is retargeted is re-evaluated, with comments updated to explain this. The dependabot-auto-merge.yml, auto-merge-on-approval.yml, pull-request-management.yml and auto-merge-github-app.md files also changed. Their diffs were trimmed, so they are not described in detail here.
• Updated the pinned github/codeql-action commit and version comment from v4.39.1 to v4.39.2 in the CodeQL analysis, security scans and scorecard workflows.

Why It Was Necessary

• Release builds may need a different runner than regular CI, for example a macOS runner for cgo darwin binaries. A separate setting allows that without changing the primary runner.
• The old env-json captured runner-specific variables such as HOME, PATH, RUNNER_* and GITHUB_*. These can be wrong for jobs that run on another runner or OS.
• A retargeted Dependabot PR keeps its head but changes its branch rules and merged commits, so its auto-merge eligibility needs a fresh check.
• The sync keeps shared CI configuration and pinned action versions aligned with the upstream source.

Testing Performed

• No tests were run for this change. It is an automated file sync, and the diff contains no test changes.
• Validation depends on the CI workflows running after merge. This includes the setup job's runner resolution and the Windows-runner rejection.
• Setting RELEASE_RUNNER to a macOS runner and pushing a v* tag would confirm the release job runs on it.

Impact / Risk

• Breaking change: Low. RELEASE_RUNNER is empty by default, so releases keep using the primary runner. Setting it to a Windows runner now fails setup with an error.
• Behavior change: Anything that relied on runner-environment variables in env-json will no longer find them. Only variables defined in the env files are included.
• Risk: Low to moderate. The auto-merge workflow changes alter when Dependabot PRs are re-evaluated or have auto-merge revoked. The tool and action version bumps are routine.