ci: self-hosted warden-sdk runner registered + docs/ci-cd.md (P5)

Registered a 3rd repo-scoped runner on bfe-mpc-0640 (label warden-sdk,
bfe-mpc-0640-warden-sdk) per ADR-0004. It is offline pending the sudo-gated steps
(service install + CPUQuota/MemoryMax cgroup cap + toolchain/python provisioning),
documented in docs/ci-cd.md as a [maintainer] handoff. kernel-build stays dispatch-gated
and passes JOBS=4 as a belt-and-braces resource bound.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

.github/workflows/ci.yml

@@ -115,6 +115,7 @@ jobs:
       - name: build zImage + rv1106-warden.dtb
         env:
           WORK: ${{ github.workspace }}/kbuild-out
+          JOBS: 4   # belt-and-braces bound in addition to the runner's cgroup cap
         run: bash build/build-kernel.sh
       - uses: actions/upload-artifact@v4
         with: