[rearden-grok]

Summary

GitHub-hosted runners share one concurrent-job cap. On a pull request, fmt, deny, ast-grep, and nixos-module-eval each took an Ubuntu runner for well under a minute, at the same time as clippy and test (and at the same time as mutants-pr when the diff touches crates).

Those four gates now share one runner, in order:

fmt → deny → ast-grep → nixos-module-eval

Check names are unchanged, so the ruleset contexts deny and ast-grep still match. Later gates use if: !cancelled() so a red earlier gate still runs the later check. A skip would hide a required status.

clippy, test, windows, and macos still start immediately. clippy stays off the chain because coverage waits on it, and a cold rust-cache is a full workspace compile. coverage still waits for fmt, clippy, and test. On a warm cache the short chain finishes before test, so the coverage critical path is unchanged.

This does not raise cargo-mutants shard count or -j. It leaves concurrent-job slots free so mutants.yml can use more shards later.

Test plan

• Required checks stay separate and green: fmt, deny, ast-grep, nixos-module-eval, clippy, test, windows, macos, coverage
• deny starts after fmt, ast-grep after deny, nixos-module-eval after ast-grep (one short Ubuntu runner at a time)
• clippy and test overlap that chain