ci(podman): report e2e-podman archive selected-vs-eligible coverage

[politerealism]

Summary

Adds a job-summary report on the e2e-podman nextest archive's coverage: how many targets are eligible under the e2e-podman feature, how many are excluded, how many are selected into the archive, and how many actually execute — so a narrow Podman CI run cannot be mistaken for full coverage.

Related Issue

Addresses the "selected-vs-eligible reporting" acceptance criterion on #3712 (Job names and summaries report the selected test set or target count so a narrow Podman job cannot be mistaken for the complete suite.).

Why this is scoped so narrowly

This issue has a lot of adjacent, actively-moving work (the e2e-podman test migration, the RPM/DEB installation-profile qualification effort, RFC 0016's broader testing-strategy discussion). Given that, this PR deliberately does only one small, self-contained thing:

• No new selection mechanism. It reuses the exact cargo nextest list invocation generate-podman-e2e-ci-tests already uses, and reads podmanE2eFollowUpBinaries — the same declarative exclusion list that already drives the archive filter — rather than introducing a second, parallel way to know what's "in scope." If that list changes, this report changes with it automatically; there's nothing to keep in sync by hand.
• No new CI gating. This only prints a summary; it doesn't fail a build, block a merge, or add a new required check. A wrong or stale number here is a documentation problem, not a correctness problem — safe to land independently of the bigger migration work in flight, and safe to delete or supersede later without unwinding any enforcement behavior.
• Output only, not a new data model. It's a handful of integers and names rendered as markdown into $GITHUB_STEP_SUMMARY. RFC 0016 (docs(rfc): propose OpenShell testing strategy #3460 / test: define and track OpenShell testing strategy #3954) is still working out "the meaning of a complete conformance result" as project-wide testing strategy; this is intentionally small enough to be cheap to redo or retire once that lands, rather than pre-empting it with a bespoke coverage model of its own.

Why precision mattered here specifically

The first version of this (see commit history) reported "selected" as eligible - excluded. That's wrong in one specific way: two of the eligible, non-excluded targets (internet_network_perf, live_internet_traffic_perf) are real #[ignore]'d manual-only benchmarks — included in the archive's scope, but never actually executed by nextest. Reporting them as "selected" without qualification would have reproduced the exact failure mode this change exists to prevent: a number that looks like full coverage but isn't, just one level removed. The final version reports eligible, excluded, selected, and actually-executing as four distinct numbers and names the manual-only benchmarks explicitly, so the report is honest about the one case where "in scope" and "runs automatically" diverge.

Changes

• tests/artifacts.nix: new podmanE2eCoverageSummary Nix app. Computes the eligible set via cargo nextest list (full listing, not binaries-only, so per-test #[ignore] status is visible), compares it against podmanE2eFollowUpBinaries, and reports eligible/excluded/selected/executing counts, naming any selected-but-ignored benchmarks.
• flake.nix: exposes it as nix run .#podman-e2e-coverage-summary.
• .github/workflows/integration-runner.yml: new step in the shared integration job, scoped to matrix.testsuite == 'e2e-podman' only, if: always() so it reports regardless of pass/fail, writing to $GITHUB_STEP_SUMMARY.
• TESTING.md / CI.md: documented in both, matching this repo's existing split (CI.md = current implemented behavior, TESTING.md = local entry points).

Testing

• nix-instantiate --parse on both modified .nix files
• YAML validity check on the modified workflow file
• Manually re-ran the exact jq/nextest pipeline against the real e2e/rust crate with a real cargo-nextest install, confirming correct output end to end: 36 eligible, 20 excluded, 16 selected (2 manual-only: internet_network_perf, live_internet_traffic_perf), 14 actually execute
• Have not run nix run .#podman-e2e-coverage-summary inside the real flake/tmachine/KVM CI environment — no working Nix daemon available in the environment this was developed in. This will get its first real exercise when this PR's CI runs.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture/CI documentation updated (TESTING.md, CI.md)

🤖 Generated with Claude Code

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.