v3.6.1 — Nx remote cache

Nx remote cache. Add nx to the remote_cache input of runs-on/action@v2 on a runner with extras=s3-cache, and Nx caches in your stack's bucket. On TanStack/query, an 87 s build restores in 2 s on a new runner. Entries can't be overwritten, which closes the cache poisoning (CVE-2025-36852) that made Nx deprecate @nx/s3-cache. See Remote caches.
Full-history checkouts use the git cache. A fetch-depth: 0 checkout used to miss the cache on every push. It now fetches only what changed from GitHub: 57 MiB instead of 17.9 GiB on kibana.
Git cache results in the job log, next to the Magic Cache line: Git cache: 3 fetches (2 hits, 1 miss), 906.2 MiB from S3, 453.1 MiB from GitHub. See Git checkout caching.
Slow starts explained on the job. When a runner starts late because EC2 had no capacity or the vCPU quota was full, the job says so and what to change.
Security fixes from an internal audit of v3, listed below.

Job steps can no longer change the tags RunsOn uses to manage their instance, so a job can't escape the stack's maximum runtime.
A forged interruption on an on-demand runner no longer triggers a rerun.
A runs-on.yml whose YAML aliases expand to more than 4 MiB is rejected, so a crafted config can't exhaust the control plane's memory.
roc connect, roc interrupt and the other job URL commands refuse instances and jobs that belong to another repository or stack.
Other hardening, Go 1.27.4 and Go dependency security updates.

Turning EnableAdminRoutes off no longer leaves the admin routes answering 500. They now answer 403.
The setup page flags a GitHub App that is not subscribed to the Workflow job or Workflow run event.

Jobs that never start:
- A job no longer stays queued forever when GitHub hands it back after its runner started it. RunsOn launches a new runner. Fixes runs-on#581.
- In large matrix bursts, jobs whose queued webhook GitHub never sent are picked up within about a minute instead of up to 8.
- A GitHub App you created yourself without the Workflow job event is now reported on every job. Before, jobs silently waited for polling.
GitHub API quota:
- Running jobs use less of the hourly GitHub quota.
- The rate-limit guard now follows the quota that GitHub returns on each response. GitHub's /rate_limit endpoint, which it used before, can lag behind, so the guard could see quota left while GitHub was already refusing calls.
- Runner registration goes through boost apps first.
- A rate-limited runs-on.yml read is retried. Before, with RunnerConfigAutoExtendsFrom, jobs could fail with "runner spec not found".
Hot pools: pool jobs pick an instance faster in large bursts.
Preinstall and prerun scripts: on Linux, programs your script starts now see the RunsOn variables (RUNS_ON_POOL_NAME…), as on Windows. Fixes runs-on#567.
extras=tmpfs: a swap file added in preinstall now grows /mnt/tmpfs.
Windows: runners start about 6 s sooner.