feat(ci): add windows-latest-32-arm-core and use it

also bigger runs where needed

.github/actionlint.yaml

@@ -7,3 +7,4 @@ self-hosted-runner:
     - ubuntu-latest-32-core
     - ubuntu-latest-32-arm-core
     - windows-latest-32-core
+    - windows-latest-32-arm-core

.github/workflows/desktop-bundle-smoke.yml

@@ -230,7 +230,7 @@ jobs:
     name: Windows install and chat
     needs: validate
     if: inputs.platform == 'win32'
-    runs-on: ${{ inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2025' }}
+    runs-on: ${{ inputs.arch == 'arm64' && 'windows-latest-32-arm-core' || 'windows-latest-32-core' }}
     # windows-11-arm runners are much slower (npm ci alone runs 12+ minutes and
     # the MSIX leg exceeds 30 total); x64 legs complete in ~14.
     timeout-minutes: 45

.github/workflows/desktop-bundled-release.yml

@@ -438,7 +438,7 @@ jobs:
       matrix:
         target:
           - label: win32-x64
-            runner: windows-2025
+            runner: windows-latest-32-core
     env: &win32-env
       CHANNEL_BUILD: ${{ needs.validate.outputs.channel-build }}
       HERMES_DESKTOP_VARIANT: bundled
@@ -736,7 +736,7 @@ jobs:
       matrix:
         target:
           - label: win32-arm64
-            runner: windows-11-arm
+            runner: windows-latest-32-arm-core
     env: *win32-env
     steps: *win32-steps
 
@@ -1434,7 +1434,7 @@ jobs:
       && needs.build-win32-x64.result == 'success' && needs.build-win32-arm64.result == 'success'
       && (inputs.release-phase == '' || inputs.release-phase == 'candidate')
       && (inputs.upload_release == true || inputs.release-phase == 'candidate' || inputs.build_commit != '' || inputs.channel != '')
-    runs-on: windows-2025
+    runs-on: windows-latest-32-core
     environment: release-signing
     cache-mode: read
     timeout-minutes: 45
@@ -1615,8 +1615,18 @@ jobs:
   publish-channel:
     name: Publish the complete native-smoked channel build
     needs:
-      [validate, build-darwin-arm64, build-darwin-x64, build-win32-arm64, build-win32-x64,
+      [
-       assemble-win32-bundle, smoke-darwin-arm64, smoke-darwin-x64, smoke-win32-arm64, smoke-win32-x64]
+        validate,
+        build-darwin-arm64,
+        build-darwin-x64,
+        build-win32-arm64,
+        build-win32-x64,
+        assemble-win32-bundle,
+        smoke-darwin-arm64,
+        smoke-darwin-x64,
+        smoke-win32-arm64,
+        smoke-win32-x64
+      ]
     if: >-
       !cancelled() && needs.validate.outputs.channel-build != '' && needs.validate.result == 'success'
       && needs.validate.outputs.darwin-arm64 == 'true' && needs.validate.outputs.darwin-x64 == 'true'
@@ -2375,7 +2385,7 @@ jobs:
     name: Submit the verified Store package
     needs: [validate, stable-publish]
     if: inputs.release-phase == 'publish'
-    runs-on: windows-2025
+    runs-on: windows-latest-32-core
     environment: release-signing
     timeout-minutes: 60
     env:

.github/workflows/install-e2e-windows-run.yml

@@ -59,7 +59,7 @@ on:
         type: string
         default: auto
       update-ref:
-        description: 'What to update TO: HEAD (the commit under test), or NEXT -- a synthetic child of install-ref that the driver mints, so a leg that installs HEAD still has an update to take (HEAD''s own updater).'
+        description: "What to update TO: HEAD (the commit under test), or NEXT -- a synthetic child of install-ref that the driver mints, so a leg that installs HEAD still has an update to take (HEAD's own updater)."
         required: false
         type: string
         default: HEAD
@@ -69,7 +69,7 @@ on:
         type: boolean
         default: true
       leg-id:
-        description: 'Artifact-safe matrix leg id (from generate-e2e-matrix.mjs legId). Names this leg''s logs + player artifacts so the report job can link a row to its zip.'
+        description: "Artifact-safe matrix leg id (from generate-e2e-matrix.mjs legId). Names this leg's logs + player artifacts so the report job can link a row to its zip."
         required: true
         type: string
       setup-exe-url:
@@ -100,7 +100,7 @@ jobs:
   bundled-e2e:
     name: packaged bundle (open-app-update)
     if: inputs.install-method == 'packaged-app' && inputs.update-method == 'open-app-update'
-    runs-on: ${{ inputs.bundle-arch == 'arm64' && 'windows-11-arm' || 'windows-2025' }}
+    runs-on: ${{ inputs.bundle-arch == 'arm64' && 'windows-latest-32-arm-core' || 'windows-latest-32-core' }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -170,7 +170,7 @@ jobs:
         || (contains(fromJSON('["installer-script+desktop", "hermes-desktop-app-update", "desktop-installer@latest"]'), inputs.update-method) && inputs.tag-has-desktop)
         || (inputs.update-method == 'open-app-update' && inputs.tag-has-desktop
             && contains(fromJSON('["desktop-installer@latest", "installer-script+desktop"]'), inputs.install-method)))
-    runs-on: windows-latest
+    runs-on: windows-latest-32-core
     timeout-minutes: ${{ inputs.timeout-minutes }}
 
     env:

.github/workflows/pm-bundle.yml

@@ -64,17 +64,17 @@ jobs:
       matrix:
         target:
           - label: linux-x64
-            runner: ubuntu-24.04
+            runner: ubuntu-latest-32-core
           - label: linux-arm64
-            runner: ubuntu-24.04-arm
+            runner: ubuntu-latest-32-arm-core
           - label: darwin-arm64
             runner: macos-15
           - label: darwin-x64
             runner: macos-15-intel
           - label: win32-x64
-            runner: windows-2025
+            runner: windows-latest-32-core
           - label: win32-arm64
-            runner: windows-11-arm
+            runner: windows-latest-32-arm-core
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/tests-os.yml

@@ -12,7 +12,7 @@ name: OS-specific tests
 # is where those markers actually execute:
 #
 #   macos    → ``-m platforms``    on macos-latest
-#   windows  → ``-m platforms``    on windows-latest-32-core and windows-11-arm
+#   windows  → ``-m platforms``    on windows-latest-32-core and windows-latest-32-arm-core
 #
 # (tests/conftest.py's ``pytest_collection_modifyitems`` hook skips
 # foreign-OS ``platforms(...)`` markers on each host, so one shared ``-m
@@ -53,7 +53,6 @@ jobs:
   os-tests:
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
-    # windows-11-arm is a 4-core runner that builds sdists on the way in.
     timeout-minutes: ${{ matrix.timeout || 30 }}
     strategy:
       fail-fast: false
@@ -66,7 +65,7 @@ jobs:
             runner: windows-latest-32-core
             marker: windows
           - name: Windows-only tests (arm64)
-            runner: windows-11-arm
+            runner: windows-latest-32-arm-core
             marker: windows
             timeout: 60
     steps:
@@ -164,9 +163,9 @@ jobs:
           HERMES_TEST_WORKERS: ${{ matrix.marker == 'windows' && (runner.arch == 'ARM64' && '2' || '8') || '' }}
           # Belt-and-suspenders with tests/conftest.py's env blanking: no
           # test may reach a real provider API.
-          OPENROUTER_API_KEY: ""
+          OPENROUTER_API_KEY: ''
-          OPENAI_API_KEY: ""
+          OPENAI_API_KEY: ''
-          NOUS_API_KEY: ""
+          NOUS_API_KEY: ''
 
   e2e-windows:
     # Real Hermes processes on a real Windows host (tests/e2e/core/windows): hermes.exe,
@@ -208,9 +207,9 @@ jobs:
           HERMES_TEST_WORKERS: '6'
           HERMES_TEST_FILE_TIMEOUT: '900'
           HERMES_TEST_FILE_RETRIES: '0'
-          OPENROUTER_API_KEY: ""
+          OPENROUTER_API_KEY: ''
-          OPENAI_API_KEY: ""
+          OPENAI_API_KEY: ''
-          NOUS_API_KEY: ""
+          NOUS_API_KEY: ''
 
       - name: No leftover Python / Hermes processes
         # Backstop for the per-test ownership checks: a file killed by its 900 s timeout,

.github/workflows/windows-bundle-sdk.yml

@@ -29,7 +29,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [windows-2025, windows-11-arm]
+        runner: [windows-latest-32-arm-core, windows-latest-32-arm-core]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/windows-venv-e2e.yml

@@ -15,7 +15,7 @@ name: Windows venv-holder live E2E
 on:
   push:
     branches:
-      - "wine2e/**"
+      - 'wine2e/**'
   workflow_call:
     inputs:
       release:
@@ -38,7 +38,7 @@ concurrency:
 jobs:
   venv-holder-e2e:
     name: venv-holder live E2E (windows-latest)
-    runs-on: windows-latest
+    runs-on: windows-latest-32-core
     timeout-minutes: 25
     steps:
       - name: Checkout code