ci: reuse one package and balance test jobs - #734

Summary

CI repeats the same Bun suite across Node versions, rebuilds the package in each lane, and leaves most Windows tests in two large shards. Build one checked archive, keep the full Bun suite on every OS, and use the supported Node matrix for installed-package checks.

Changes

• Build and inspect one package archive, then use that same artifact throughout the workflow run. Keep native plugin-build tests and the installed CLI, credential-locking, NodeNext, dashboard, MCP, and nested-worker checks.
• Run three measured file shards on Linux and macOS and seven on Windows. Include new test files automatically and keep the machine-wide PowerShell test serial.
• Give MCP tests their own required job. Run pytest with four isolated workers, work stealing, and no automatic worker restarts.
• Keep diagnostic reports optional while preserving the required check names and rejecting failed, canceled, or skipped required jobs in full CI.
• Keep the async subprocess checks and serializable Python subtest labels without changing their inputs or assertions.
• Merge current main and refresh all three workflow-file estimates from the merged test-split PR's final successful CI run. Remove the duplicate-file guard: the runner obtains unique entry names from readdir, and the full-inventory tests still verify that every shared file runs exactly once.

Testing

• On the refreshed branch, 312 focused checks passed across the shard runner, workflow safeguards, CLI launcher, and MCP tool-discovery tests.
• SDK and MCP type checks, SDK formatting, and git diff --check passed.
• The updated shard assignments include all 111 shared files exactly once on both Unix and Windows. The optional-report tests retain real passing and failing subprocesses with writable and blocked report directories.
• The three workflow-file estimates match the Linux JUnit report and Windows test logs from the referenced successful CI run. These are scheduling estimates, not a claim about total CI speedup.

Risk and rollout

No production code changes. Real process, database, filesystem, and installed-package coverage remains intact across the supported platforms. Package artifacts are required and tied to the current workflow run; dependencies are installed separately on each platform.

The sharding helper retains invalid-count checks and tests for complete inventory coverage. The removed duplicate-input test exercised a case that cannot occur with the filesystem inventory. Refresh duration estimates after expensive tests change. MCP timing reports become available when the native MCP runner lands.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.