ci: Fix CI tests and runners

.github/workflows/ci.yml

@@ -1,11 +1,5 @@
 name: CI
 
-# The pull-request loop stays cheap: Lint, Test on Linux, and MSRV. The
-# platform-specific and packaging checks are slower or billed at a premium and
-# their failure modes do not depend on a given PR's diff, so they run once on
-# merge instead of on every push. Advisories are time-dependent rather than
-# code-dependent and live in advisories.yml on a schedule.
-
 on:
   pull_request:
   push:
@@ -48,19 +42,12 @@ jobs:
       # advisories.yml.)
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
-          command: check
+          command: check licenses bans sources
 
   test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
+    name: Test
+    runs-on: ubuntu-latest
     timeout-minutes: 35
-    strategy:
-      fail-fast: false
-      matrix:
-        # macOS runners bill at 10x Linux and every developer here builds on
-        # macOS continuously, so the second platform is worth one run per merge
-        # rather than one per push.
-        os: ${{ github.event_name == 'pull_request' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest"]') }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-rust
@@ -84,19 +71,3 @@ jobs:
         with:
           toolchain: "1.88.0"
       - run: cargo check --locked --all-targets
-
-  package:
-    name: Package
-    # Only the `include` list and the manifest can break this, and a failure on
-    # merge is still well before `cargo publish`.
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-rust
-        with:
-          toolchain: stable
-      # Builds the crate as packaged, so an `include` list that drops a file the
-      # build needs fails here rather than after `cargo publish`.
-      - run: cargo package --locked

CONTRIBUTING.md

@@ -67,16 +67,8 @@ Pull requests also run the declared MSRV:
 rustup run 1.88.0 cargo check --locked --all-targets
 ```
 
-Two more checks run on merge to `main` rather than on every push — macOS (its
-runners bill at a premium, and local development already covers the platform)
-and the published package:
-
-```bash
-cargo package --locked
-```
-
-If you change the `include` list in `Cargo.toml`, run that one yourself; it is
-what catches an `include` list that drops a file the build needs.
+If you change the `include` list in `Cargo.toml`, run `cargo package --locked`
+locally; it is what catches an `include` list that drops a file the build needs.
 
 A scheduled workflow re-runs `cargo deny check` weekly against `main`. Security
 advisories are published against dependency versions rather than commits, so