CI wall time: remaining levers after the cache-save fix and the suites fan-out

[lann]

Findings from a review of recent CI runs (warm baseline: run 31456208804 — 10m10s total; critical path conformance 6m00s → conformance-webkit 3m23s → conformance-aggregate 0m37s; the conformance job's nine-target parallel phase is ~5m and its measured tail is deltic-deno at 267.1s + 26.6s, serial). #370 fixed the silent conformance-artifacts cache-save failure; #371 unblocked the engine legs from the conformance matrix (expected warm total ≈ 6.5m). What remains, in payoff order:

• Shard the deltic-deno leg. @deltic/ct-runner's runSuite is a single-threaded case loop and run.ts runs the two suites sequentially — the only unstriped target in the matrix. Upstream ask filed as ct-runner: shard option on runSuite (the serial case loop is a consumer's CI tail) lann/deltic#110 (a shard option mirroring runCases' i % count contract); the repo side is a Deno Web Worker fan-out in conformance/driver-ct/deltic/run.ts with per-worker freshCases: false (the containment trade run.ts already argues) and a stripe merge. Interim micro-step available now: run the two suites concurrently, hiding the signing 27s. Expected: the ~294s tail drops to ~90–120s, taking the conformance job to ~4.5–5m.
• Adopt wizer pre-initialization for the wasmtime-family legs once Productize wizer pre-initialization: library entry point, setup action, discoverability polymorph-test#85 productizes it (the wizen_with checkbox is the blocking one: the shared suite imports polymorph:webcrypto/*, so only the composed artifact is wizen-able with the shipped bin). Upstream's 10k-case K=1 bench: 30.8s → 1.14s at --jobs 8; run-wasmtime (53s) and run-composed collapse to seconds, and the freed CPU share pulls in the whole phase on the 4-vCPU runner. The wizened artifacts slot into the existing conformance-artifacts cache; the weekly mutants oracle (which runs both suites single-threaded per mutant) gains the sequential ~4x.
• conformance-aggregate: restore the artifact cache before installing the Rust toolchain, and skip rustup on a hit (~12s; the job sits at the very end of the critical path — the toolchain only serves the miss path's build fallback).
• run-wasmtime's signing invocation has no --jobs (conformance/driver-ct/justfile) — seconds, one flag.
• Artifact-cache key over-invalidation residue (conformance-ct: gate wall time — sequential targets, per-run jco transpile, over-broad CI cache key #307 follow-up): the key hashes rust/** and wit/** wholesale, so wit/README.md and crate README edits repay the build. Narrowing needs care around include_str! doc includes; low priority now that a miss costs ~1.5m warm-cargo instead of a double-pay.

Not worth doing: fanning the remaining ubuntu targets across more jobs (after the above, the phase is genuinely parallel work on 4 vCPUs; another split buys ~1m for duplicated setup and artifact plumbing), and demoting the engine legs to main-only (they are first-class gates by design).

[lann]

#373 takes the three unblocked items: the aggregate-job cache/rustup reorder and the missing --jobs (both boxes ticked), plus the shard item's interim micro-step — run-deltic now runs the two suites as concurrent processes, hiding the signing leg's ~27s. That box stays open: the worker fan-out proper is still blocked on lann/deltic#110, and the wizer item on polymorph-components/polymorph-test#85.