ci: hosted runners cannot enable Defender RTP — revert runner-side gating

Dry run 30225685743 failed at the ensure-defender step on every
Windows job: the hosted images policy-lock real-time protection OFF
(WinDefend starts, Set-MpPreference accepts, RTP stays off —
untamperable from the job).

Revert to the pre-gate runner behavior: no ensure-defender step in
runner jobs, the release Defender scan is on-demand and fail-soft
again. The local VM preflight KEEPS the fail-closed Defender-ON gate
(same canonical script) — AV-interaction coverage is a deliberate
local superset where the platform allows it.

The venue-parity contract now enforces the INVERSE for runners
(ensure-defender must not gate hosted jobs) and still requires the VM
preflight gate; VM README documents the verified posture delta.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/_smoke.yml

@@ -172,10 +172,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
-
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
@@ -258,9 +254,7 @@ jobs:
             if ($code -eq 2) {
               Write-Host "BLOCKED: Windows Defender flagged $binary!"; exit 1
             } elseif ($code -ne 0) {
-              # ensure-defender gates this job earlier, so the engine MUST be
-              # available here: an engine failure is a red gate, never a skip.
-              Write-Host "BLOCKED: Defender scan engine could not run for $binary (exit $code) - Defender-ON parity violated"; exit 1
+              Write-Host "::warning::Windows Defender scan could not run for $binary (exit $code) - skipping AV gate on this runner"
             } else {
               Write-Host "=== Windows Defender: $binary clean ==="
             }

.github/workflows/_soak.yml

@@ -93,9 +93,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: CLANG64
@@ -153,9 +150,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: CLANGARM64
@@ -271,9 +265,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: CLANG64

.github/workflows/_test.yml

@@ -247,11 +247,12 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      # Defender parity: every Windows venue (local VM and runner alike) tests
-      # with real-time protection ACTIVE — enabled + verified, never skipped.
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
+      # Defender posture: real-time protection is POLICY-LOCKED OFF on hosted
+      # Windows images (verified 2026-07-27: WinDefend starts and
+      # Set-MpPreference accepts, but RTP stays off — untamperable from the
+      # job). The local VM leg enforces Defender-ON via the canonical Defender
+      # preflight script, so AV-interaction coverage lives there; runners run
+      # without RTP by platform constraint.
 
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
@@ -381,10 +382,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
-
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: CLANG64

.github/workflows/pr.yml

@@ -84,11 +84,6 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Ensure Windows Defender is active (venue parity)
-        if: matrix.os == 'windows-latest'
-        shell: pwsh
-        run: scripts/ci/ensure-defender.ps1
-
       - name: Install deps (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         run: sudo apt-get update && sudo apt-get install -y zlib1g-dev ccache