ci: balance full macOS coverage across two isolated shards

[yansigit]

Summary

• Split full macOS coverage on promotion pushes, main-targeting PRs/merge groups, and manual dispatch across two timing-balanced hosted runners. Preserve focused dev/PR coverage and the nightly unsharded control.
• Derive platform lanes from the existing manifest, preserving fresh-process isolation for every serial and dedicated test. Keep Windows' six hosted timing-aware shards intact.
• Validate the complete, disjoint test inventory and reject unsafe line-delimited paths. Tradeoff: an extra hosted macOS runner/setup per full run; actual speedup requires CI measurement.

Verification

• 162 focused workflow/lane tests passed using the repository Bun binary; typecheck, workflow lint, privacy scan, and diff checks passed.
• Explicit security review by the Omen subagent approved permissions, pinned actions, cache trust, shell input handling, test coverage, and aggregate gating.
• Required PR CI passed at 5b468c3cd: https://github.com/yansigit/opencodex/actions/runs/34147509287 (Linux, focused macOS, all six Windows shards). Required hygiene, enforce-target, and mergeable checks also passed.
• Manual dispatch exercised both new full macOS shards successfully: https://github.com/yansigit/opencodex/actions/runs/34147543838. Its first attempt failed in the unchanged Windows client-connect disconnect-foreign test at its internal 15-second child-process deadline; the corresponding required PR run passed at the same commit. A single failed-job rerun passed without code changes, and the manual run is now fully green (attempt 2).
• Full local bun run test --timeout 60000 completed: 21,920 passed, 17 skipped, one service-port assertion failed due to the required OCX_BAKE_PORT=18123 safety override. No timeout/assertion changes were made to obtain green results.
• Local testing used a temporary OPENCODEX_HOME. Live config hash/mtime changed during the last run; writer attribution is unknown, no new invalid/backup files appeared, and local testing was stopped without restoring or reconfiguring production state.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Added/updated tests for behavior changes under src/ or gui/src/, or obtained test-exception-approved (check: bun run check:hygiene). CI-only change with focused regression coverage; no runtime behavior changes.
• Docs or release notes were updated when needed. No public behavior changes.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

PR automation (bot-owned)

• Class: same-repo-human (same-repo-human)
• Base: 8c6b592aa41f963b791ecbb61bc2d06d63abc7ef
• Head: 5b468c3cda21d675312fe99324280685646f4dbe
• Action: observed
• Exact-head gate: BLOCKED (not-mergeable, check-not-success)
• Sensitive paths: .github/workflows/ci.yml
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: wait for exact-head checks