Align the build-runner repositories with the current template

Seven build-runner repositories had drifted from the shared template, each with a different subset of checks, a different ignore list, and in several cases no formatting or security configuration at all.

All seven now follow the current template. Each also had its permissions moved off the namespace's shared default identity onto one of its own, so a runner's access is no longer inherited by every other workload beside it.

One repository was deliberately left on its own pipeline: it is deployed by hand rather than automatically, and the shared pipeline would fail on that layout.