[HackTuah]

CI only, plus one census test and one assurance-case line. Nothing a consumer of the package can hit changes.

Why. GitHub moves ubuntu-latest to Ubuntu 26.04 in November 2026 (actions/runner-images#14748). Every job on that label would change image, and the OpenSSL its OTP links would move from 3.0.13 to 3.5.5, with no commit here to say so. Named images move only in a commit, as the pinned actions already do.

What changes

• Named images everywhere. The floor, pinned and head gate legs, the gate's body, quality-gate and DCO jobs, conformance's x86_64 row, provenance and scorecard go from ubuntu-latest to ubuntu-24.04, the image they already ran on. Nothing changes under them in this commit.
• The box leg moves to ubuntu-26.04-arm. A fielded box's image pins OpenSSL 3.5 or later. The 24.04 runner's OTP links 3.0.13 and the 26.04 runner's links 3.5.5, so the leg now runs the OpenSSL line the box runs. builds.hex.pm publishes OTP 28.5.0.8 for ubuntu-26.04 on arm64, and beam_mcp_signer's box leg already runs there.
• A census in governance_test.exs: no workflow names a -latest label, every runs-on is a named image or the matrix's os, and every image a matrix supplies is named by version.
• A gate.yml comment said "all three" legs on the edited-body path; tools/ci_legs_verdict.sh already requires four.

Evidence

• The census fails on main's workflows (conformance.yml:40) and passes after the change.
• Putting a label back to ubuntu-latest, or a runs-on naming macos-15, fails it.
• GATE_LEG=pinned ./tools/gate.sh: exit 0, "Gate OK." (the first local run failed only on formatting the new test; fixed).

Not yet measured

• The box leg on ubuntu-26.04-arm for this repository; this run is its first.
• The 26.04 runner images are a public preview ([Ubuntu] Ubuntu 26.04 and Ubuntu 26.04 Arm is now available as a public preview actions/runner-images#14226).