docs(ci): make runner probes pool-aware

[eilandert]

Summary

Make step 15's runner-identity probes conditional on the POOL_OWNED decision already recorded in step 3.

For hosted-only adopters, the reference selector must still be absent and rejected. For adopters registered with the MyGuard pool, the approved selector must remain accepted while an unregistered selector must be rejected.

Adoption evidence

During nginx-http-sentinel-module adoption, the target was correctly classified POOL_OWNED=yes and uses the registered builder02,lxc pool. The old universal acceptance text required:

• no builder02 or self-hosted selector to survive; and
• the policy checker to reject that same approved selector.

Those expectations contradicted steps 13–14 and would have forced a valid pool-owned adopter onto hosted runners. The target's actual two-direction policy probe showed the intended behavior: builder02,lxc passed and unregistered-probe,lxc failed.

Validation

• LINT_ONLY=spelling ci/linter/run-all.sh ci/PROMPT.md
• tracked pre-commit hook (all staged checks clean)

[coderabbitai]

Walkthrough

The CI prompt updates runner verification to use POOL_OWNED. It validates approved selectors according to target ownership and requires unregistered selectors to fail in both ownership modes.

Changes

Runner verification

Layer / File(s)	Summary
Ownership-aware runner checks ci/PROMPT.md	Step 15 and Probe 2 now distinguish hosted-only and pool-owned targets. Approved selectors are allowed only for owned pools. Unregistered selectors must fail in both ownership modes. Acceptance and diagnostic guidance reflect these checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the documentation change and the conditional, pool-aware runner probes.
Description check	✅ Passed	The description directly explains the POOL_OWNED conditions, expected probe behavior, adoption evidence, and validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pool-owned-runner-probes

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/pool-owned-runner-probes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d6dc3c11-f18d-47d6-961f-f209c54bf17c

📥 Commits

Reviewing files that changed from the base of the PR and between 5b3b806 and 2374e6f.

📒 Files selected for processing (1)

• ci/PROMPT.md

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Keep Step 14 and Step 15 consistent for POOL_OWNED=yes.

Step 14 currently instructs adopters to empty TRUST_SPLITS without a POOL_OWNED condition. That makes the checker reject every self-hosted selector, so the approved-selector expectation in Lines 810-812 cannot pass.

State the branch explicitly: empty TRUST_SPLITS for POOL_OWNED=no, and retain only the registered target selector for POOL_OWNED=yes.

Also applies to: 810-812