ci: pin runners to ubuntu-26.04

[derek-miller]

GitHub moves the ubuntu-latest label to the Ubuntu 26 image between 2026-10-19 and 2026-11-19. This pins every job to ubuntu-26.04, the current LTS, so the runner image is explicit and the CI on this PR shows now whether anything breaks on the new image instead of during the rollout.

[svc-finitelabs]

Not approving yet. One job breaks on the new image, which is the thing this PR is meant to surface.

lua-openssl 0.8.5-1 (Control4 DriverWorks build) fails at luarocks install (job):

src/ocsp.c:190:29: error: passing argument 4 of 'PEM_ASN1_read_bio' from incompatible pointer type [-Wincompatible-pointer-types]
src/ocsp.c:366:30: error: ... (same)
Error: Build error: Failed compiling object src/ocsp.o

It's a compiler change, not OpenSSL. 0.8.5's PEM_read_bio_OCSP_* macros pass char ** where void ** is expected. GCC 13 on ubuntu-latest only warns about that. GCC 14 made -Wincompatible-pointer-types an error by default. The newer bindings (0.9.2-2, 0.11.1-1) build cleanly, and so do all six Lua test jobs and Check. On main the last run (bcca8b4) still passes this job. Build Combined Module is skipped because it needs the matrix.

Suggested fix: override luarocks' default CFLAGS (the build line shows exactly -O2 -fPIC) for this install:

      - name: Install lua-openssl ${{ matrix.rock }}
        # GCC 14+ makes -Wincompatible-pointer-types an error; 0.8.5's src/ocsp.c trips it.
        run: luarocks install openssl ${{ matrix.rock }} CFLAGS="-O2 -fPIC -Wno-error=incompatible-pointer-types"

The job tests the binding's API surface against what Control4 ships, not our toolchain, so relaxing this one diagnostic keeps what the job checks. Applying the flag to all three rocks is harmless and avoids a per-matrix conditional. I haven't tested this on the 26.04 image (CI here only runs on PRs to main, and I didn't want to open a throwaway PR), so this PR's next CI run is the test.

The other option is pinning just openssl-matrix to ubuntu-24.04. That works, but it puts this job back on a moving label, which is what the PR is getting away from.

Everything else is fine: all five runs-on across build.yml and release.yml are updated, and nothing else under .github/ references a runner label. release.yml only runs on tags, so the first release after merge is its first run on 26.04.

[svc-finitelabs]

The CFLAGS override works on the 26.04 image. In the lua-openssl 0.8.5-1 job the flag reaches the compile line (gcc -O2 -fPIC -Wno-error=incompatible-pointer-types ...), and the two src/ocsp.c diagnostics that failed the last run now show up as warnings. After that the feature-gate assertion and make test-all both run and pass. Every other job is green too, and Build Combined Module runs again now that the matrix passes.