A self-hosted runner group is moved to a new subnet, but the internal package mirror allowlist still trusts only the previous CIDR

The jobs land correctly, yet dependency downloads fail because network identity changed while the workflow labels stayed the same.