The standby lane itself is push-only, but under failover pull_request jobs do reach these runners with the PR merge ref's workflow. The workflow comment and the larger-runner note (both languages) now state that plainly and name the actual boundary — repository membership (private, forking disabled, Dependabot excluded) — matching the runbook. Static gate green locally: 32 passed, 0 failed.