[anth-volk]

Fixes #4144

Stacked on #4140.

Summary

Pull requests run the test suite in the same six shards as the release run, and check that each test ran in exactly one.

• pr.yml's test job has the same strategy as push.yml's release-tests: a matrix of shard_index 1 to 6 with fail-fast: false. Its step still runs make test, with PYTEST_ADDOPTS: -p tests.release_test_shard_plugin and the three RELEASE_TEST_SHARD_* variables set as run_release_tests.sh sets them. Each shard uploads the tests it collected and ran as the artifact release-test-shard-<n>, with the same upload step as the release run.
• check-test-shards (new job) has the same steps as check-release-test-shards: it downloads the six reports and runs python -m scripts.release_test_shards check-coverage --shard-count 6. "CI complete" needs it. It has no condition of its own, so when a shard fails, or on a stacked pull request above the lowest one, it is skipped and "CI complete" fails.
• Coverage: each shard uploads the coverage of its own tests to Codecov, which merges the uploads for a commit, as it already does with the cross-database integration tests' upload.
• Rules registry: every pr.yml job must enforce a registered rule, so api.quality.tests-pass now names check-test-shards too, and says each test runs in exactly one shard. docs/generated/rules.md is regenerated.
• docs/engineering/skills/testing.md describes the pull request shards.

The job runs make test rather than run_release_tests.sh because 34 rules in rules/registry.toml name pr.yml's test job with the invocation make test, which the registry check looks for in the job's commands. The script's other work, removing deployment settings, has nothing to remove here: the pull request job sets none of them.

Expected effect

• On Keep the release test split's settings out of pytest runs that tests start #4140's last full run (41067605238), Test took 27.7 minutes. In release run 41063091599, the release shards took 2.9 to 5.3 minutes each.
• "Cross-database integration tests" took 29.3 minutes on the same pull request run, so the workflow stays about that long until that job is also shorter.
• A change that breaks the split now fails on its own pull request. Nothing ran the split before Split the release tests over six runners, and stop repeating the merge run's checks on the release commit #4134 merged, so release run 41063091599 was the first to find Keep the release test split's settings out of pytest subprocesses #4139.
• The job uses six runners instead of one, each repeating the setup steps (dependency install, Redis, Google Cloud sign-in).

Environment variables

No new secrets or variables. The step's new variables are literals, or come from the matrix and runner.temp. The job's secrets are unchanged, and each shard gets them the same way the single job did:

• Repository secrets: POLICYENGINE_DB_PASSWORD, CODECOV_TOKEN, GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_DEPLOY_SERVICE_ACCOUNT.
• Organization secrets: OPENAI_API_KEY, PE_UK_PRIVATE_HF_READ_TOKEN (as HUGGING_FACE_TOKEN), POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN.
• Repository variable: OLD_SIMULATION_GATEWAY_URL, set for the whole workflow.

check-test-shards reads no secrets.

Unverified until this pull request's CI runs

This pull request sits above #4140, so its CI skips every job and "CI complete" fails by design until #4140 merges and this one is rebased.

• That all six shards pass on pull request runners, and that check-test-shards passes.
• That Codecov merges six uploads per commit. Its checks are not required, but it may report lower coverage until every shard has uploaded.

Testing

• Red: b0535a1 (tests only). test_pull_requests_run_the_tests_in_the_release_runs_shards and test_ci_complete_needs_every_pull_request_test_to_have_run_once in tests/unit/test_release_test_shards.py both failed: pr.yml's test job had no matrix, and there was no check-test-shards job.
• Green: 02e9925. Both tests pass.
• python scripts/run_quality_guards.py: every guard passed. python -m scripts.rules render produced the docs/generated/rules.md change included here.
• ruff format --check and ruff check on the changed test files, with the ruff version uv.lock pins (0.15.12): clean. actionlint .github/workflows/pr.yml: clean.
• Only the two new tests were run locally.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.16%. Comparing base (22c4f36) to head (e2e3640).
⚠️ Report is 9 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4145       +/-   ##
===========================================
+ Coverage   50.63%   88.16%   +37.52%     
===========================================
  Files         258      274       +16     
  Lines       14955    16393     +1438     
  Branches     2399     2689      +290     
===========================================
+ Hits         7573    14453     +6880     
+ Misses       6751     1271     -5480     
- Partials      631      669       +38     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.