ci: isolate remaining Rust compiles

agent-identity: dev3.direct.omp.uyt54www
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.1.7
agent-runtime: OMP 18.1.7
tooling-profile: dotfiles@39a19af

Author: schickling-assistant

.github/workflows/nix.yml

@@ -10,8 +10,8 @@ concurrency:
   group: nix-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-# Linux uses three balanced shards: after compilation sharing, more shards add setup cost
-# without materially shortening the longest remaining provider chain. The aggregation job
+# Linux uses four build-graph shards so each remaining cold Rust derivation gets a
+# runner instead of competing with an unrelated compile. The aggregation job
 # preserves the stable `check-x86_64-linux` status used by branch protection.
 jobs:
   check-x86_64-linux-shard:
@@ -30,12 +30,14 @@ jobs:
               .#checks.x86_64-linux.completions
               .#checks.x86_64-linux.hooks-replacement
               .#checks.x86_64-linux.pty-fleet-contract
-              .#checks.x86_64-linux.release-integration
-              .#checks.x86_64-linux.pi-extension-types
           - group: providers
             targets: >-
               .#checks.x86_64-linux.provider-components
               .#checks.x86_64-linux.wasip2-resource-providers
+          - group: integration
+            targets: >-
+              .#checks.x86_64-linux.release-integration
+              .#checks.x86_64-linux.pi-extension-types
           - group: wasm
             targets: >-
               .#checks.x86_64-linux.wasm-resolver-feature

flake.nix

@@ -301,27 +301,33 @@
             "github_issue_component"
             "--test"
             "github_pr_component"
-            "-p"
-            "st2"
-            "--features"
-            "st2/wasip2-provider-runtime"
-            "--test"
-            "resource_profile_supervisor_e2e"
-            "--test"
-            "resource_provider_e2e"
           ];
-          postCheck = extraCargoTest {
-            label = "wasip2 resource executor";
-            flags = [
-              "-p"
-              "st2-resource-wasip2"
-              "--features"
-              "runtime"
-              "--lib"
-              "--test"
-              "executor"
-            ];
-          };
+          postCheck =
+            extraCargoTest {
+              label = "wasip2 supervisor integration";
+              flags = [
+                "-p"
+                "st2"
+                "--features"
+                "wasip2-provider-runtime"
+                "--test"
+                "resource_profile_supervisor_e2e"
+                "--test"
+                "resource_provider_e2e"
+              ];
+            }
+            + extraCargoTest {
+              label = "wasip2 resource executor";
+              flags = [
+                "-p"
+                "st2-resource-wasip2"
+                "--features"
+                "runtime"
+                "--lib"
+                "--test"
+                "executor"
+              ];
+            };
         });
 
         # Sandbox-safe integration episodes the package's own release-mode boundary cannot reach,