chore(workflows): complete migration to Blacksmith cloud runners (#435)

* chore(workflows): complete migration to Blacksmith cloud runners

Migrate remaining workflows from self-hosted axecap runners to Blacksmith:
- docker.yml: publish job
- release.yml: publish job
- security.yml: audit and deny jobs (conditional on push events)

This completes the transition away from self-hosted infrastructure.
Axecap runner registrations (IDs 21, 22) have been removed.

All workflows now use blacksmith-2vcpu-ubuntu-2404 label for consistency.

* Merge branch 'main' into selfhost-blacksmith

.github/workflows/docker.yml

@@ -61,7 +61,7 @@ jobs:
     publish:
         name: Build and Push Docker Image
         if: github.event_name == 'push'
-        runs-on: [self-hosted, Linux, X64, lxc-ci]
+        runs-on: blacksmith-2vcpu-ubuntu-2404
         timeout-minutes: 25
         permissions:
             contents: read