fix: macOS Tahoe window regression (pin CI runners, rebalance traffic lights)

.github/workflows/codeql.yml

@@ -8,7 +8,9 @@ on:
 
 jobs:
   analyze:
-    runs-on: macos-latest
+    # Only javascript-typescript is analyzed here, which needs no macOS toolchain.
+    # ubuntu is faster/cheaper and sidesteps the macos-latest -> macos-26 migration.
+    runs-on: ubuntu-latest
     permissions:
       security-events: write
 

.github/workflows/pr-checks.yml

@@ -6,7 +6,9 @@ on:
 
 jobs:
   test:
-    runs-on: macos-latest
+    # Pinned to macos-15 to match the release build env (release.yml) and avoid
+    # the macos-latest -> macos-26 toolchain jump breaking PR builds mid-rollout.
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/release.yml

@@ -81,7 +81,10 @@ jobs:
             arch: arm64
           - target: x86_64-apple-darwin
             arch: x64
-    runs-on: macos-latest
+    # Pinned to macos-15: macos-latest migrated to macos-26 (Tahoe) in June 2026,
+    # whose SDK makes desktop builds adopt Tahoe's new window chrome (misplaced
+    # traffic lights + white frame). Pin keeps a reproducible, pre-26 SDK build.
+    runs-on: macos-15
     permissions:
       contents: write
 
@@ -241,7 +244,10 @@ jobs:
 
   release-cli-windows:
     needs: create-release
-    runs-on: windows-latest
+    # Pinned to windows-2025 so a future windows-latest OS-major migration can't
+    # silently change the build env (same control-your-upgrade-timing rationale
+    # as the macos-15 pin). Keeps the current, working Server 2025 + VS2026 image.
+    runs-on: windows-2025
     permissions:
       contents: write
     steps:

crates/hk-desktop/tauri.conf.json

@@ -15,7 +15,7 @@
         "title": "HarnessKit",
         "hiddenTitle": true,
         "titleBarStyle": "Overlay",
-        "trafficLightPosition": { "x": 16, "y": 12 },
+        "trafficLightPosition": { "x": 16, "y": 18 },
         "decorations": true,
         "width": 1280,
         "height": 800,