[anth-volk]

Fixes #4144

It was stacked on #4140, which has merged, so it now targets master.

Summary

Pull requests run the test suite in the same six shards as the release run, and check that each test ran in exactly one.

• pr.yml's test job has the same strategy as push.yml's release-tests: a matrix of shard_index 1 to 6 with fail-fast: false. Its step still runs make test, with PYTEST_ADDOPTS: -p tests.release_test_shard_plugin and the three RELEASE_TEST_SHARD_* variables set as run_release_tests.sh sets them. Each shard uploads the tests it collected and ran as the artifact release-test-shard-<n>, with the same upload step as the release run.
• check-test-shards (new job) has the same steps as check-release-test-shards: it downloads the six reports and runs python -m scripts.release_test_shards check-coverage --shard-count 6. "CI complete" needs it. It has no condition of its own, so when a shard fails, or on a stacked pull request above the lowest one, it is skipped and "CI complete" fails.
• Coverage: each shard keeps its coverage.xml as the artifact test-coverage-shard-<n>, and upload-test-coverage (new job, needs test, needed by "CI complete") downloads all six and sends them to Codecov in one upload. Codecov so gets two uploads per pull request, this one and the cross-database integration tests', as before the split. With an upload from each shard (this PR's first version), Codecov updated its checks after each of the seven uploads and left codecov/patch in progress, with no output, on e2e3640. The rules registry lists upload-test-coverage under discovery.ignore_jobs, because it checks nothing.
• Rules registry: every pr.yml job must enforce a registered rule, so api.quality.tests-pass now names check-test-shards too, and says each test runs in exactly one shard. docs/generated/rules.md is regenerated.
• docs/engineering/skills/testing.md describes the pull request shards.

The job runs make test rather than run_release_tests.sh because 34 rules in rules/registry.toml name pr.yml's test job with the invocation make test, which the registry check looks for in the job's commands. The script's other work, removing deployment settings, has nothing to remove here: the pull request job sets none of them.

Expected effect

• On Keep the release test split's settings out of pytest runs that tests start #4140's last full run (41067605238), Test took 27.7 minutes. In release run 41063091599, the release shards took 2.9 to 5.3 minutes each.
• "Cross-database integration tests" took 29.3 minutes on the same pull request run, so the workflow stays about that long until that job is also shorter.
• A change that breaks the split now fails on its own pull request. Nothing ran the split before Split the release tests over six runners, and stop repeating the merge run's checks on the release commit #4134 merged, so release run 41063091599 was the first to find Keep the release test split's settings out of pytest subprocesses #4139.
• The job uses six runners instead of one, each repeating the setup steps (dependency install, Redis, Google Cloud sign-in).

Environment variables

No new secrets or variables. The step's new variables are literals, or come from the matrix and runner.temp. The job's secrets are unchanged, and each shard gets them the same way the single job did:

• Repository secrets: POLICYENGINE_DB_PASSWORD, CODECOV_TOKEN, GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_DEPLOY_SERVICE_ACCOUNT.
• Organization secrets: OPENAI_API_KEY, PE_UK_PRIVATE_HF_READ_TOKEN (as HUGGING_FACE_TOKEN), POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN.
• Repository variable: OLD_SIMULATION_GATEWAY_URL, set for the whole workflow.

check-test-shards reads no secrets. upload-test-coverage reads CODECOV_TOKEN, the same repository secret the shards' upload step read before.

Unverified until this pull request's next CI run

On e2e3640, the run before the coverage change, all six shards passed (8 to 13 minutes each) and so did check-test-shards.

• That the Codecov uploader sends the six reports in upload-test-coverage as one upload, and that Codecov then shows two uploads for the commit and completes both of its checks.

Testing

• Red: b0535a1 (tests only). test_pull_requests_run_the_tests_in_the_release_runs_shards and test_ci_complete_needs_every_pull_request_test_to_have_run_once in tests/unit/test_release_test_shards.py both failed: pr.yml's test job had no matrix, and there was no check-test-shards job.
• Green: 02e9925. Both tests pass.
• python scripts/run_quality_guards.py: every guard passed. python -m scripts.rules render produced the docs/generated/rules.md change included here.
• ruff format --check and ruff check on the changed test files, with the ruff version uv.lock pins (0.15.12): clean. actionlint .github/workflows/pr.yml: clean.
• Red: 5b9e530. test_codecov_gets_one_upload_for_every_pull_request_shard failed: there was no upload-test-coverage job.
• Green: 39881dd. It passes, with the two tests above. python scripts/run_quality_guards.py and actionlint .github/workflows/pr.yml: clean.
• Only these three tests were run locally.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.15%. Comparing base (22c4f36) to head (39881dd).
⚠️ Report is 32 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4145       +/-   ##
===========================================
+ Coverage   50.63%   88.15%   +37.51%     
===========================================
  Files         258      286       +28     
  Lines       14955    16659     +1704     
  Branches     2399     2733      +334     
===========================================
+ Hits         7573    14685     +7112     
+ Misses       6751     1300     -5451     
- Partials      631      674       +43     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.