ci(id): every main run builds the pkgs/id checks twice — the PR-tier matrix and the full flake check both run on push/schedule since the main-only trigger change

Evidence (main 0f84fe08, verified this run)

.github/workflows/id-check.yml has had no pull_request trigger since 814c5146 ("ci: main-only workflow triggers, cancel-in-progress everywhere", 2026-10-30, Drew's main-only order). Its on: block (id-check.yml:44-58) is now: push to main (paths pkgs/id/** + the workflow/guard files), a nightly schedule (41 8 * * *), and workflow_dispatch. But the job graph still contains BOTH tiers, and nothing gates either one off for push/schedule events:

• PR tier: guard ("basic: guard PR check list") → check_each, a matrix over the 26 checks in .github/scripts/id-pr-checks.txt → the check aggregator ("nix flake check"). No if: on guard or check_each.
• Main tier: full-flake-check ("full (main tier): nix flake check"), whose only gate is if: github.event_name != 'pull_request' — a dead condition, since the workflow can no longer receive that event. It has no needs: on the matrix, so it starts in parallel and cannot reuse the matrix jobs' cache uploads from the same run.

The matrix set is a subset of the full check by construction: the guard script check-id-pr-checks.sh exists to keep id-pr-checks.txt in sync with pkgs/id/flake.nix's checks (every flake check is either listed or explicitly excluded as heavy), and the workflow's own comment on full-flake-check says the full check is the PR set "including the heavy checks the PR list excludes". So every push-to-main run — and every nightly schedule run — builds each of the 26 fast derivations twice: once as its own matrix job, once inside the full flake check.

Live confirmation: run 41183833194 (push, 2026-10-31T08:15Z) — the jobs API shows, in one run, basic: guard PR check list, all 26 basic: nix flake check (<name>) matrix jobs, and full (main tier): nix flake check (28 jobs at query time; the aggregator is created once the matrix completes, for 29). The 2026-10-31 nightly main-broken report (#3038) likewise names both a basic: matrix failure and the full nix flake check failure from the same tree.

The docs still describe the pre-814c5146 world: the workflow header says it "Runs on push to main and PRs that touch pkgs/id/ files", the concurrency comment explains how "Pull-request runs keep sharing a per-ref group", and .github/ci-policy.md's table still lists the id PR tier as "guard + affected-crate matrix (id-pr-checks.txt)" — a tier that can never run on a PR again.

Why it matters

The matrix split (#869) and the PR-tier slimming (#1781) existed to stop paying for the same derivations repeatedly; the main-only trigger change silently reintroduced the duplication on the one event that now fires most — every merge to main that touches pkgs/id. That is ~26 extra Nix builds per merge (plus the guard and aggregator jobs), competing for the same runner pool the fleet already queues on (#1599), and doubling the surface for flaky-check noise on main (a matrix flake and the same check inside the full run can disagree, producing two differently-named failures for one tree, as #3038 shows). This is not a request to restore PR triggers — the main-only order stands — it is about making the job graph match it.

Acceptance criteria

• A push-to-main (and schedule) run of the id workflow builds each pkgs/id check derivation at most once: e.g. the PR-tier jobs (guard/check_each/check) are removed or gated off for push/schedule, OR full-flake-check is restructured so it no longer re-runs the matrix set — with the chosen shape recorded in the workflow header.
• The drift guards (check-id-pr-checks.sh, check-crash-gate-coverage.sh) still run exactly once per main run, in whichever job survives.
• The dead github.event_name != 'pull_request' condition on full-flake-check is resolved, and the workflow header comment + .github/ci-policy.md's id row describe the main-only reality (no PR tier that cannot fire).
• Evidence on the closing PR: the job list of a post-change push run, showing no check name appearing in both a matrix job and the full-tier job.

Distinct from: #3039 (host-eval job not a required check in nix-ci), #2936 / #1579 (pm-stack paths with no PR CI at all), #1780/#1781 (the original tier design, closed), #1599 (runner queueing — this issue reduces load, it is not the queueing bug).