Actions: Remove experimental self-hosted runner query

Runner labels cannot reliably distinguish self-hosted runners from managed runners. Deprecate the supporting SelfHostedQuery library module.

Author: JarLob

actions/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -11,7 +11,6 @@ ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
-ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
 ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
 ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
 ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql

actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `codeql.actions.security.SelfHostedQuery` module has been deprecated because runner labels do not reliably distinguish self-hosted runners from managed runners.

actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll

@@ -1,3 +1,8 @@
+/**
+ * DEPRECATED: Runner labels do not reliably distinguish self-hosted runners from managed runners.
+ */
+deprecated module;
+
 import actions
 
 bindingset[runner]