ci: stop compiling the tree three times on macOS/Windows PRs; drop NVML on macOS

[srperens]

Problem

The macOS and Windows jobs compile the dependency tree about two and a half times per run. Today's Windows log has 210 compile lines for clippy, 550 for the tests and 551 for the release build:

• cargo clippy is a check build: metadata only, no codegen. The test build cannot reuse it, apart from build scripts and proc-macros.
• cargo build --release is a different profile from the test build, so every dependency compiles again.

On a pull request the release binary is not used for anything. A PR carrying ci:macos or ci:windows asks the job to verify the platform code, and clippy plus the tests already do that.

Separately, the nvidia feature is a default feature, so it is in every macOS build. NVML does not exist on macOS, so every macOS start logs NVML initialization failed and nvidia-smi also unavailable, and GPU monitoring stays off. The --features ...,nvidia in CI and the pre-commit hook is redundant, and the hook's comment calls nvidia "opt-in", which it is not.

Change

• Release build only off pull requests. In the macOS and Windows jobs, Build and Upload backend binary run on push and workflow_dispatch, not on pull_request. Main and dispatch keep producing artifacts.
• CARGO_PROFILE_DEV_DEBUG=line-tables-only in the CI env. Backtraces keep file and line, the full debuginfo is dropped, test binaries link faster and sccache objects get smaller. Release is unaffected.
• NVML off macOS. nvml-wrapper moves to [target.'cfg(not(target_os = "macos"))'.dependencies], and the NVML code in system_monitor.rs is gated on all(feature = "nvidia", not(target_os = "macos")). The GpuStats import moves behind the same cfg. The build with --no-default-features was already broken by that unused import, and is fixed too.
• One concurrency group per pull request. The group added in ci: probe a write in the sccache preflight, add a concurrency group #989 gave each label its own group, so a later push never cancelled a label run. On this PR that meant macOS and Windows building three times at once on two commits. Now every push and every ci: label event shares the PR's group and cancels the run in progress. A label run therefore runs the whole workflow, not only the platform builds. Any other label gets a throwaway group and skips every job, so labelling a dependabot PR still costs nothing.
• Redundant nvidia removed from --features in ci.yml, scripts/pre-commit and scripts/install-hooks.sh.

Rejected: dropping clippy on macOS/Windows. It is the cheap step, a check build, and it is the only lint pass over cfg(target_os) code on those platforms.

Evidence

• Compile counts per step: Windows job of run 37301526767 (210 / 550 / 551 Compiling/Checking lines).
• The release step being skipped on a PR: this PR's own macOS and Windows runs, which carry ci:macos / ci:windows.
• The NVML gating compiles cleanly on macOS: cargo clippy --workspace --all-targets --features efp -- -D warnings, and the same with --no-default-features, both run locally on macOS.
• The NVML path on Linux/Windows still compiles: unverified locally, covered by this PR's Linux and Windows CI.
• That the two NVML warnings no longer appear at macOS startup: unverified, I did not start the server. It follows from the cfg, since the code that logs them is not compiled.

Tests

Ran: the two clippy invocations above, on macOS, both clean. Pre-commit hook.
Not run: cargo test locally. Left to CI, including macOS and Windows through the labels.

For the reviewer

• Adding ci:macos / ci:windows to a green PR now re-runs the Linux jobs too. They run in parallel with the longer platform builds, so the run takes no longer.

• PRs with ci:macos / ci:windows no longer build or upload a release binary. A release-profile-only break (LTO, cfg(debug_assertions)) would first show on main.

• line-tables-only changes every dev-profile fingerprint, so the first runs after merge rebuild rust-cache and sccache once.

Out of scope

• EFP on Windows. Tried in this PR and reverted. efp-sys does not build with MSVC: efp-sys/efp-cmake/CMakeLists.txt in Eyevinn/efp passes the GCC/Clang flag -include algorithm, which MSVC reads as a source file (C1083: Cannot open source file: 'algorithm'). This needs a fix in Eyevinn/efp first, probably /FIalgorithm plus /EHsc for MSVC.
• macOS mediaplayer::bridge timing tests (a_live_timeline_with_a_stall_plays_on_time_in_the_main_pipeline, playback_carries_on_in_time_after_a_file_switch) have failed on every macOS main run since feat(mediaplayer): play live streams, extra tracks and URLs #945. They are unrelated to this PR and handled separately.

🤖 Generated with Claude Code

[srperens]

Verdict: Comment. The changes are sound and I found nothing to change. I can't approve yet: Check (Linux) is red at this head, from a GL test that this diff cannot reach, and the Windows run that compiles the NVML path is still pending.

Posted as a COMMENT review: this PR is from the account this stage runs under.

Claims

Claim	Verdict	Evidence
The Linux red is not this diff	CONFIRMED	source_switch_fits_when_caps_are_stored_late panicked with start GPU vision mixer pipeline: StateChange(... current: Paused, pending: Playing) (job 111798095421). The previous head 4879220 carried the same Rust and Cargo changes and its Check (Linux) passed; compare 4879220...84219c8 is one commit that touches only the macOS job in ci.yml. The test also passed in both of today's main runs (jobs 111765296879, 111797523977)
NVML gating compiles on macOS	CONFIRMED	At 4879220, Build (macOS) got past clippy into cargo test (888 passed; 2 failed). The two failures are the mediaplayer::bridge timing tests that #991 addressed on main
NVML path still builds on Linux	CONFIRMED	backend/Cargo.toml:10 — default = ["nvidia"], and --features efp adds to the defaults. Check (Linux) got through clippy at this head
NVML path still builds on Windows	UNVERIFIED	Build (Windows) is pending at 84219c8. At 4879220 it failed in the efp-sys cmake step, so NVML was never reached
nvidia is redundant in --features	CONFIRMED	backend/Cargo.toml:12 — nvidia = ["dep:nvml-wrapper"] is a default feature. The optional dep moves under backend/Cargo.toml:151 — [target.'cfg(not(target_os = "macos"))'.dependencies]

Diagnosis: A check build cannot feed a test build, and release is a separate profile, so cutting the PR-side release compile is the only one of the three compiles that can go without losing a check. Release-only breaks (LTO, cfg(debug_assertions)) now surface first on main; the body discloses this. The concurrency group at .github/workflows/ci.yml:29 — group: ci-${{ github.ref }}${{ (github.event.action == 'labeled' && !startsWith(github.event.label.name, 'ci:')) && format('-unrelated-label-{0}', github.run_id) || '' }} keys on the label that was just added. The old gates keyed on contains(...labels...), which matched any later label event on a PR that already carried ci:macos, so this also fixes that.

Radius: SHARED. In the product, only macOS changes: it stops probing NVML (backend/src/system_monitor.rs:109 — #[cfg(not(all(feature = "nvidia", not(target_os = "macos"))))]). In CI, every PR's run selection changes. A ci: label now re-runs the Linux jobs, and labelling a dependabot PR still skips everything. Linux keeps the same features, and line-tables-only changes debuginfo only.

Overlaps:

• #810 adds a ci:cef label, edits the same preflight if:, and adds jobs with the old github.event.action != 'labeled' gate. Land this one first. #810 then rebases onto the prefix form, which covers ci:cef with no extra clause.
• #897 removes impl Default from system_monitor.rs and lines from backend/Cargo.toml. These are separate hunks, so at most a trivial conflict.
• #809 edits the Linux cargo test line (xvfb-run, efp,nvidia) and will conflict textually.

Tests & CI: Green at 84219c8: Build (Linux x86_64/ARM64), Check & Build (WASM), API Contract Check, Static JS Tests. Check (Linux) is red (see first row); every test binary before vision_mixer_source_resize_test, including pipeline_lifecycle_test, passed. Build (macOS) and Build (Windows) were pending when I read the checks. A re-run of Check (Linux) plus a green Windows job would meet the approval bar.

Confidence: HIGH