Select runner and container by org and repo visibility

[cboettig]

Makes the workflow work in three places instead of one: this public template
repo, private student repos in espm-157, and any other instructor's copy.

Previously runs-on: arc-runner-espm157 was hardcoded. That runner exists only
in this org and, since it was hardened, only accepts private repos — so this
public template's own CI hung forever, and so did any copy another instructor
generated, because that runner does not exist in their org at all.

Now both the runner and the container are selected from context:

• private repo in espm-157 -> arc-runner-espm157 + container: rocker/ml
  (the course environment, on our cluster)
• anything else -> ubuntu-latest, no container, using actions/setup-python

The container is deliberately dropped on the hosted path. rocker/ml runs as
jovyan (uid 1000) while the Actions workspace is owned by runner (uid 1001),
so on a GitHub-hosted runner it fails with

EACCES: permission denied, open '/__w/_temp/_runner_file_commands/...'

The only fix there is options: --user ..., which ARC's kubernetes mode
forbids. On the self-hosted side the uid is set in the runner's hook pod
template instead, which is why the container works there and is not needed here.

Both paths verified green before opening: this branch on ubuntu-latest
(checkout, setup-python, pip install, pytest), and the self-hosted path on a
private espm-157 repo with the same steps.