fix: CI fails — 'forjar apply' exits 127 on self-hosted runner (command not found)

[noahgift]

Summary

`unified / cpu-gates` job fails on self-hosted runner with exit code 127:

```
make[1]: *** [infra/machines/clean-room/Makefile:517: _provision] Error 127
make: *** [infra/machines/clean-room/Makefile:482: _run-clean-room] Error 2
```

Run: https://github.com/paiml/alimentar/actions (2026-04-05T15:04)

The failing command is:
```
cd $(INFRA_ROOT) && forjar apply --yes --force-unlock -f /tmp/clean-room-$(REPO)/forjar.yaml
```

Exit 127 = shell cannot find the `forjar` binary.

Five-Whys

1. Why does CI fail? — `forjar` command not found on the runner (exit 127)
2. Why is forjar not found? — binary not in PATH for the self-hosted runner that picked up this job
3. Why? — self-hosted runner env doesn't install forjar, OR forjar was removed from runner PATH, OR the runner is a new one that hasn't been provisioned
4. Why runner-specific? — path shows `/home/noah/data/actions-runner` — this is a noah-Lambda-Vector runner (not mac-server)
5. Why isn't forjar installed? — the alimentar CI workflow assumes forjar is pre-installed on runners, but runner provisioning (infra/machines/*/forjar.yaml) hasn't run install-forjar step for this host

Fix Options

(a) Add a "cargo install forjar" step to alimentar's ci.yml before calling make
(b) Provision forjar onto the noah-Lambda-Vector self-hosted runner via forjar.yaml
(c) Pin alimentar CI to runners that have forjar pre-installed (mac-server)

Refs paiml/infra repo (runner provisioning)