Three flake classes hitting every PR today, all on self-hosted runners:

1. Verus + Rocq Proofs: "sudo: 'no new privileges' flag is set"
2. Mutation Testing (rivet-cli): "No space left on device"
3. Supply Chain (cargo-vet): "runner has received a shutdown signal"

All three block green CI on PRs that have nothing to do with the
underlying subsystem. Each fix is workflow-level so it lands without
runner-host changes.

**1) Verus + Rocq: switch Nix installer.**
The self-hosted runners run with systemd `NoNewPrivileges=true`, which
breaks `cachix/install-nix-action@v31` because it shells out to sudo
mid-install. Switch to `DeterminateSystems/nix-installer-action@main`
with `init: none` (daemonless single-user mode). Add a follow-up step
to put `~/.nix-profile/bin` on PATH explicitly. Cost: ~30s install,
comparable speed once cached. Keeps the lean-mem requirement intact —
the Verus solver still wants the RAM.

**2) Mutation Testing: prune + restrict upload.**
cargo-mutants writes a per-mutant target directory under `mutants-out/`.
Seventeen shards landing on the same pool, with the Swatinem cache hot,
leave 5-15 GB behind each. The next shard's `Upload mutants report`
step dies with ENOSPC during the upload itself — after cargo-mutants
has finished cleanly. Two changes:
  - Add a `Prune stale mutants artefacts` step before the run (rm
    mutants-out, find + rm matching target subdirs older than a day).
  - Restrict `upload-artifact` path to the text/JSON reports only —
    skip the per-mutant target directories that drive the bloat. The
    text reports are what matter for triage.

**3) cargo-vet: wrap in retry.**
GitHub Actions doesn't expose "runner restarted under me" to `if:`
conditions, but `nick-fields/retry@v3` with `retry_on: error` handles
it correctly — if the runner agent dies mid-step the step exits
non-zero, the action retries on a different runner. Two attempts is
enough; a third shutdown in ten minutes would point at runner-pool
sizing, not at this job. Same pattern fits other light jobs (`fmt`,
`yaml-lint`, `msrv`, `docs-check`) but those aren't currently flaking,
so leave them alone — speculative retry on stable jobs hides real
bugs.

Cross-cutting note for runner-ops: the underlying fixes for these are
host-level too — drop `NoNewPrivileges` from the runner systemd unit
(fixes #1), lower the `post-job.sh` disk threshold from 70% to ~50%
(helps #2), grow the lean-mem pool size (helps #3). The workflow-level
changes here unblock CI today; the host-level work is the durable fix
and worth a separate Ansible PR.

…link (#302)

User-reported regressions against `rivet import-results --format junit`:

**Bug #1: silent overwrite on re-import.** `suite_to_run` built
`run_id = format!("junit-{safe_name}")` from the testsuite name only,
so two CI runs of the same suite produced identical filenames and the
second import wiped the first.

Fix: append a disambiguator to the run_id. When the JUnit
`<testsuite timestamp="...">` attribute is present (most CI tooling
emits it), slugify it: `2026-05-17T06-35-44Z`. When absent, hash the
suite's case list (name, classname, outcome variant) and append as
16-hex DefaultHasher digest. Identical re-imports of the same artefact
remain idempotent (same hash → same filename → no churn); different
content distinguishes itself.

**Bug #2: test→artifact link dropped on cargo-nextest output.**
`artifact_id_for` has 4 heuristics; the fallback emits a literal
`"classname.name"` concatenation that the test-coverage report cannot
join back to any artifact. cargo-nextest doesn't bracket
`[REQ-NNN]` or use the artifact ID as classname, so most rivet-on-rust
projects hit the fallback.

Fix: hook the JUnit importer into `test_scanner`. New public
`parse_junit_xml_with_markers(xml, markers)` adds a 5th heuristic —
when the existing fallback fires, look up a marker whose `test_name`
matches the case name (exact or suffix with separator). The CLI
(`cmd_import_results_junit`) scans the project's `src/`+`tests/` for
`// rivet: verifies REQ-NNN` markers before parsing the XML, then
passes them to the new function. Bracketed and direct-classname IDs
are preserved (they short-circuit before the marker lookup).

Existing `parse_junit_xml` kept working unchanged (delegates to the
new path with an empty marker slice). No schema changes.

Tests added (6):
- run_id_includes_timestamp_when_present
- run_id_stable_hash_when_no_timestamp
- run_id_different_hash_when_content_differs
- marker_lookup_supplies_artifact_id_when_fallback_concat
- marker_lookup_does_not_override_explicit_bracket
- marker_lookup_returns_fallback_when_no_match

Workspace: 1003 lib tests pass (was 996, +7). Clippy clean. Format clean.

Trace: skip

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>