ci: macOS 全量也装不下一片 —— 扇出改为逐平台按实测总量定

上一轮 linux 三片全过(1h17/1h09/44m),macOS 单片在 1h30m20s 撞顶。

原注释只从墙钟论证 macOS 不该分片(并发为 1,分了也串行),漏了另
一半:**每个分片是独立 job、各有各的 timeout-minutes**,所以分片同时
也是「让活装得下」的手段。串行不要紧,跑不完才要紧。

macOS 全量实测 6922s = 115 分钟,本来就超 90 上限;它此前能过,只是
因为总量刚好卡在线下,而 grpc-codegen(macOS 1715s)把它推了过去。

改为三平台同一条规则:从 tests/member-timings.tsv 求本次成员在该平台
的实测总和,每 ~70 分钟一片(在 90 上限下留 ~20 分钟冷缓存余量),
上限按各自 runner 并发定(linux 3 / macOS 2 / windows 2)。

本机核验:
  全量        linux 3 片 ~75min · macOS 2 片 ~57min · windows 2 片 ~67min
  本 PR 四成员 linux 2 片 ~44min · macOS 1 片 · windows 1 片
linux 全量是最紧的一档(实测最慢片 77/90),注释已写明后续两个杠杆。

Author: Sunrisepeak

.github/workflows/validate.yml

@@ -404,40 +404,65 @@ jobs:
                      "$1" "$2" "$3" "$4" "$5" "$6" "$i" "$7"
             done
           }
-          # Shard count follows the WORK, not the full/partial flag.
+          # Shard count follows the WORK, per platform, measured.
           #
-          # It used to be binary — full run: linux 3, anything else: linux 1 —
-          # which reads "a partial run is small". It is not: touching a widely
-          # consumed descriptor selects every member that consumes it. This
-          # PR's `pkgs/c/compat.openssl.lua` selected four (grpc-codegen,
-          # grpc-module, asio-ssl, openssl), one shard got all of them, and
-          # linux was cancelled at exactly 1h30m — the job cap — with
-          # grpc-codegen (3563s) and grpc-module (1701s) back to back. Nothing
-          # was broken; the plan just could not fit.
+          # It used to be binary — full run: linux 3 / macos 1 / windows 2,
+          # anything else: 1 each — which asserts two things that are not
+          # true. "A partial run is small": touching a widely consumed
+          # descriptor selects every member that consumes it, and this PR's
+          # `pkgs/c/compat.openssl.lua` selected four; one linux shard took
+          # grpc-codegen (3563s) and grpc-module (1701s) back to back and was
+          # cancelled at exactly 1h30m, the job cap. "A full macOS run fits in
+          # one shard": at 6922s measured it does not — it fit only while the
+          # total sat just under the cap, and the run that added grpc-codegen
+          # (1715s on macOS) pushed it to 1h30m20s.
           #
-          # tests/member-timings.tsv already holds the measured cost of every
-          # member, and plan_shards.lua already packs by it (LPT). So size the
-          # fan-out from the same table: sum this run's members and give linux
-          # a shard per ~45 minutes of work, capped at 3 (above that, runner
-          # concurrency and the per-shard setup eat the gain — see the
-          # measurement in the comment above). macOS stays at 1: its
-          # concurrency is 1, so extra shards there run back to back.
-          if [ "$full" = 1 ]; then
-            ln=3; mn=1; wn=2
-          else
-            secs=$(lua5.4 -e '
-              local want = {}
-              for m in (os.getenv("MEMBERS") or ""):gmatch("%S+") do want[m] = true end
+          # Sharding is not only a wall-clock lever. Each shard is its own job
+          # with its own `timeout-minutes`, so it is also how the work is made
+          # to FIT. That is the half the "macOS concurrency is 1, so extra
+          # shards run back to back" note above left out: back to back is fine
+          # when the alternative is not finishing.
+          #
+          # tests/member-timings.tsv already holds every member's measured
+          # cost and plan_shards.lua already packs by it (LPT), so the fan-out
+          # comes from the same table: sum this run's members for that
+          # platform and take one shard per ~70 minutes, which leaves ~20
+          # minutes of headroom under the 90-minute cap for a cold cache.
+          #
+          # The caps are where runner concurrency comes back in: linux 3 (the
+          # measured concurrency — a 4th shard would queue), macOS 2, windows
+          # 2. Past those, more shards buy fit that is already there and pay
+          # another checkout + mcpp download + cache restore.
+          #
+          # Full run, from the table: linux 13570s over 3 -> ~75min/shard
+          # (observed slowest 77), macOS 6922s over 2 -> ~57, windows 8043s
+          # over 2 -> ~67. linux is the tight one — its cap binds before the
+          # ~70-minute target does, so it is the first place to look if a
+          # cold full run starts brushing 90 again. The levers, in order:
+          # raise the linux cap to 4 (costs a queued runner), then the job
+          # timeout.
+          shards_for() {   # platform cap -> shard count
+            local secs
+            secs=$(XPLAT="$1" lua5.4 -e '
+              local plat = os.getenv("XPLAT")
+              local sel, all = {}, (os.getenv("MEMBERS") == "__ALL__")
+              if not all then
+                for m in (os.getenv("MEMBERS") or ""):gmatch("%S+") do sel[m] = true end
+              end
               local total = 0
               for line in io.lines("tests/member-timings.tsv") do
                 local p, m, s = line:match("^(%S+)\t(%S+)\t(%d+)$")
-                if p == "linux" and m and want[m] then total = total + tonumber(s) end
+                if p == plat and m and (all or sel[m]) then total = total + tonumber(s) end
               end
               print(total)')
-            ln=$(( secs / 2700 + 1 )); [ "$ln" -gt 3 ] && ln=3
-            mn=1; wn=1
-            echo "linux work: ${secs}s (measured) -> $ln shard(s)"
-          fi
+            local n=$(( secs / 4200 + 1 ))
+            [ "$n" -gt "$2" ] && n="$2"
+            echo "$1 work: ${secs}s (measured) -> $n shard(s)" >&2
+            echo "$n"
+          }
+          ln=$(shards_for linux 3)
+          mn=$(shards_for macos 2)
+          wn=$(shards_for windows 2)
           {
             printf '{"include":['
             emit linux   ubuntu-latest  linux-x86_64   tar.gz bin/mcpp     registry/bin/xlings     "$ln"