ci: split the long test rows, shard the full CI legs and run them on the larger hosted runners - #544

…the larger hosted runners

A post-merge round of CI on main 2cd229f took 94 minutes (ubuntu Release 74,
native 74, live-sanitizers 91, live-tsan 64, kernel 58, sanitizers 52, Debug 42)
because each leg ran its ~1,240 ctest rows on half of a shared 16-core VM, with
a handful of single rows of 8 to 65 minutes setting the critical path. This
change splits those rows into parallel rows that run exactly the same cases,
lets ci_verify.py spread the native-live profiles over shard jobs like the other
profiles, and moves the legs to the larger hosted runners.

Test rows (each: K slice rows + one public cover row that proves, from the
program's own enumeration, that the union of the slices is the old row's case set
with no overlap; the old row name is gone; labels, TMPDIR and conditions are kept)
- test_ci_verify (3,911 s on the Release leg): 8 unittest slices.
- test_ci_preflight (963 s): 8 unittest slices (lab: 20 to 58 s each).
- test_native_command_after (1,916 s, 72 seeded books): 8 slices; one book alone
  takes 563 s on one core (live 60, lower path, full window, calculate-on-fills)
  and has a slice of its own; the other heavy books are spread; the rows that
  hold them carry a COST hint so ctest starts them first (COST orders the start,
  it is no time limit).
- test_open_report_rows_flat (1,080 s): 4 slices; each 100000-lot branch stays
  whole so its ordered fold is not split (lab: two slices of 493 s).
- native_live_equivalence_e2e (3,334 s of the live-sanitizers ctest): one row per
  probe (8 rows) through the existing adapter, which forwards --probes.
- The registered-row floors follow: +28 rows in every engine profile, +8 more for
  the equivalence rows in native: RELEASE_MIN_TESTS 938, KERNEL_MIN_TESTS 365,
  absent-fixture floors 631 and 334, EXCLUDED_REGISTERED_MIN debug 904,
  sanitizers 895, native 1000, release 923, kernel 365, live floor 21 (20 without
  transport); PR_SLOW_ROWS pins the 43 literal slow names as an ordered tuple.

ci_verify.py
- --ctest-shard I/N is accepted for the native, live-sanitizers and live-tsan
  profiles; the union validator and the shared-stage rules cover them.

Workflows
- ci-post.yml: Release runs as 4 shard jobs and Debug as 2 on pf-linux-x64-16,
  kernel-only as 2 on pf-linux-x64-16, sanitizers as 4 on pf-linux-x64-32;
  aggregate jobs keep the old check names so the release gate's required legs do
  not change, and skip together with the shards on a classified docs-only change.
- native-live.yml: live-sanitizers and live-tsan on pf-linux-x64-64 (not sharded:
  every shard would rebuild the instrumented tree); native as 4 shard jobs on
  pf-linux-x64-16 with an aggregate native-live (native) that needs every shard.
- ci_preflight.py, its tests and actionlint.yaml: an exact runner pin per job, the
  labels refused for every other job, the shard list 1..N with N equal to the
  --ctest-shard denominator, the aggregates and the proofs.

Flat-RSS sink test (docker/pineforge_sink_finalize_test.py only)
- The flat-RSS test judged one tiny and one 64 MiB probe per mode against a 1 MiB
  bound and failed on the scatter of the tiny baseline. It now runs three
  fresh-process probes of each size per mode and decides by min(big) - max(tiny)
  in the pure function rss_flatness_verdict; the bounds are unchanged (a 64 MiB
  peak may exceed the tiny peak by at most 1 MiB and must stay within the tiny
  baseline plus 2 MiB). A planted-retention row (2 MiB kept, file and stdout mode)
  and a positive control with the same launcher and no retention show that a
  launcher reporting a zero peak or measuring the wrong process cannot pass; the
  rows record rss_headroom_to_bound_bytes and rss_retention_planted.

docs/ci.md and the pages that cite its floor table are updated (docs/ci.md keeps
its line count). The sentences that leave were added by 91353de (the
registration constants and floors, the undivided minTests, the 29-row slow
inventory and 41 source-labelled names), dad2530 (the single equivalence row and
the native floor), 0212cab (the full-run floors, the slow label and
EXCLUDED_REGISTERED_MIN paragraphs), b0f4341 (the post-fleet routing and
runner-split paragraphs), 6c95d82 (the amd64 and arm64 cell sentences),
065ef1d (the three native-live matrix cells), 3a0d150 (the native-live row of
the runner table and the larger-runner label sentence), e11d9fc (the release and
kernel rows of the floor table), b97c409 (the two numbers are constants of the
profile) and d093560 (the 29 CTest rows labelled slow).

Not run on the author's machine.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…he sliced test rows

The sliced rows (K literal slice rows running one program, plus a public cover
row) made six ctest rows fail on every full engine profile:

- test_private_fixture_reads and its controls: tests/private_fixture_reads.evidence
  cited tests/CMakeLists.txt lines that moved by 27; every citation in the
  record now names the line where its statement sits.
- test_two_world_registration and its controls: the sweep's model of
  pineforge_add_unit_test registered one same-named row per call and skipped the
  function body, so the slice rows were unknown and the slow-row guard fired.
  The model now records function definitions, binds the call arguments, follows
  the STREQUAL branch and reads literal or expanded add_test names. A reached
  CMake error now prints its expanded message; a deleted slice row is named.
- test_cr150_cmake_d: every compiled add_test name needed its own .cpp. A name
  of the form <program>_slice_<i> is now accepted only when i is in 1..K, the
  program's .cpp exists and defines the --slice parser and dispatch, and the
  command is exactly <program> --slice I/K. Plain unknown names still need
  their own source.
- test_native_command_after_slices_cover: the branch pattern expected the
  closing parenthesis right after the first exclusion of the helper's elseif;
  it now accepts any number of further literal exclusions of the same argument.

New controls, each red on the old checker: argument branches and literal rows
in the registration model, a deleted real slice row, six shared-source slice
cases (valid rows, missing program, index outside 1..K, plain unknown name,
wrong command, program without parser or dispatch), and compound exclusions in
the cover pattern. No registration, floor, label or doc line changes.

Not run on the author's machine.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>