Migrate matcherConfig exactMatch → bidirectionalLabelMatch (due at v8 upgrade)

## Background

`exactMatch` in `matcherConfig` was **deprecated** upstream in terraform-aws-github-runner **v7.9.0** (PR github-aws-runners/terraform-aws-github-runner#5031, merged 2026-07-03) in favour of the new `bidirectionalLabelMatch`. We use `exactMatch: true` in all six `templates/runner-configs/*.yaml`.

This issue tracks migrating off it. **Not urgent** — see timeline — but it needs a coordinated change with the `infra` repo, so capturing it now while the context is fresh.

## Timeline / urgency

The upstream module removes deprecated variables **only at the next major version**, never in a minor/patch:

| Major | Date | Removed deprecated vars |
|---|---|---|
| v5.0.0 | 2023-10-27 | #3567 |
| v6.0.0 | 2024-12-20 | #4073, #4276, #4319 |
| v7.0.0 | 2025-12-13 | #4945 |

Majors land ~once a year. `exactMatch` was only just deprecated (v7.9.0), and there is **no v8 milestone yet**. So realistic removal is **≈ v8.0.0, plausibly late 2026**.

We pin the module version explicitly (`version = "v7.9.0"`), so removal **cannot** reach us by surprise — it only arrives when we deliberately `terraform init -upgrade` to a v8, at which point the changelog will flag it as a breaking change. **Action: do this migration as part of the eventual v7 → v8 upgrade.**

## Why it's not a simple flag flip

`bidirectionalLabelMatch: true` is **stricter** than `exactMatch`:
- `exactMatch`: job labels must be a **subset** of the runner's labels (runner may have extras).
- `bidirectionalLabelMatch`: **exact two-way** set match — no extras or missing on either side.

The module (`modules/multi-runner/main.tf`) **unions `labelMatchers` into the runner's registered labels** *and* adds default labels `self-hosted` + `` + ``. So a runner's real label set is often larger than a short `runs-on`. Effective runner label sets:

| Config | Runner's registered labels |
|---|---|
| linux-x64 | `{self-hosted, ce, linux, x64}` |
| linux-x64-small | `{self-hosted, ce, linux, x64, small}` |
| linux-x64-medium | `{self-hosted, ce, linux, x64, medium}` |
| linux-arm64 | `{self-hosted, ce, linux, arm64}` |
| **linux-x64-builder** | `{self-hosted, ce, lin-builder, linux, x64}` |
| **windows-x64-win-builder** | `{self-hosted, ce, win-builder, windows, x64}` |

Under `bidirectional`, any workflow whose `runs-on` isn't **exactly** the runner's full set stops matching. The builders are the problem: their jobs use short forms like `runs-on: [lin-builder]`.

## Migration plan (do together, in one coordinated change)

1. **This repo:** flip `exactMatch: true` → `bidirectionalLabelMatch: true` in all six `templates/runner-configs/*.yaml`.
2. **infra repo:** update the builder workflows' `runs-on` to the exact full label set — see compiler-explorer/infra companion issue (linked below).
3. Apply, then verify with `adhoc-command` probes on every tier (especially `lin-builder` / `win-builder`) that jobs still get picked up.

Per the upstream PR, the alternative to editing `runs-on` is removing extra labels from runner configs — but the auto-added `self-hosted`/os/arch defaults make that insufficient for the one-label builder forms, so fixing `runs-on` is the right path.

## Refs
- Upstream deprecation PR: github-aws-runners/terraform-aws-github-runner#5031
- Companion infra issue: compiler-explorer/infra#2212

Start with all six templates/runner-configs/*.yaml files and the linked infra issue compiler-explorer/infra#2212. Change the matcher setting together with the builder workflow label updates, then apply and use adhoc-command probes on every runner tier, especially lin-builder and win-builder, to verify jobs are picked up.

Written by the indexing model from the issue text.