SSO detection is already handled at the error-message level via
extractFixHint in pin_summary.go, making the X-GitHub-SSO header
capture (ssoTransport, SSOURL(), ssoMu, ssoURLRE) redundant.

Removes the transport wrapper, the SSOURL() method, the struct fields,
the run.go caller blocks, and all associated tests. The ssoFixHints()
function and extractFixHint() remain — SSO guidance still surfaces
when API errors contain SSO/SAML keywords.

The SSOURL header-capture was the only path that printed ssoFixHints()
to the terminal. Now that it's gone, render the fix hint directly in
renderUnresolvedWarnings when extractFixHint returns non-empty text.
This surfaces 'gh auth refresh' guidance next to the SSO error itself,
which is a better UX than printing it as a disconnected footer.

The SSOURL header-capture removal dropped the SSO hint from --no-fix
mode. Add reportHasSSO to scan finding Details for SSO keywords, and
use it to surface ssoFixHints() in the --no-fix exit path. Also fix
trailing blank lines flagged by gofmt.

Remove dead SSOURL header-capture mechanism

When a remote composite action's steps contain uses: ./path, we cannot
resolve transitive dependencies behind that local reference. Previously
these were silently skipped (ParseActionRef returns nil for ./ prefixes),
leaving a gap where unpinned transitive deps went undetected.

Now the BFS in ResolveAllRecursive emits a CompositeLocalPathError for
each ./path encountered in a remote composite's NestedUses. The diagnose
layer detects this error type and surfaces a LocalAction finding at error
severity, blocking the workflow.

action(relock): drop --no-onboard

When the workflow token lacks access to a private action repository,
the relock step now emits a ::warning:: annotation telling the user
to run gh actions-lock locally instead of failing the entire workflow.
This prevents Dependabot PRs from being blocked by token permission
gaps that can only be resolved locally.

Uses the nodeselector/actions-test-fixtures/composite-with-local-path
fixture which contains a composite action with uses: ./local-helper.
Asserts exit 1 and output mentioning local path actions and composite.

The relock composite action can't work in practice — the workflow
token (GITHUB_TOKEN) doesn't have access to private action repos
like github/gh-actions-lock itself, so resolution always fails.

See: github/actions-dispatch#768

…error

Remove relock composite action

The checkRefMovedAndForgery loop only iterated pw.Refs (direct workflow
uses). Transitive deps from composite actions were already in depIndex
but never checked for upstream drift. Extract the per-ref logic into
checkOneRefMoved and call it for both direct refs and depIndex entries
not already covered by a direct ref.

…-paths

Block composite local paths and detect transitive ref-moved

The hosted-only restriction was a temporary gate that is no longer needed.
All runner labels (self-hosted, custom, expression, runner groups) are now
accepted for lockfile onboarding.

The --allow-runners and -A (--allow-all-runners) flags are retained as
deprecated no-ops for backward compatibility. They will be removed in the
next minor release.

Removed:
- Self-hosted runner detection in diagnose.go and parse.go
- NonHostedRunner/NonHostedLabels fields from ParsedWorkflow
- RegisterOrgHostedLabels, IsHostedRunnerLabel, NonHostedRunnerLabels,
  HasNonHostedRunnerLabels from workflowfile/runson.go
- OrgHostedRunnerNames API client (hosted_runners.go)
- renderSelfHostedGroup, extractBracketedLabels terminal rendering
- SelfHostedRunner/ExpressionRunner from JSON skip filter, unfixable
  error checks, IsValid/IsWarning/NeedsAttention switch cases
- All related tests and scenario expectations updated

Remove hosted/self-hosted runner restrictions