Repo variables are not supplied to fork-triggered pull_request runs, so
the OPENCLAW_CI_RUNNER_BACKEND breaker silently fell through to bare
Blacksmith labels for fork PRs; mirror ci.yml's fork-to-hosted fallback.
OpenGrep precise/full, sandbox-common-smoke, and plugin-init scaffold
validation were still pinned to Blacksmith runners outside ci.yml, so
PR checks starved during the Blacksmith outage even with
OPENCLAW_CI_RUNNER_BACKEND=github. Route them through the same breaker
expression and bound sandbox-common-smoke with a timeout.