ci(macOS): shielded DPP builder test can exceed runner budget and cancel coverage job

Summary

The macOS Rust workspace coverage job can be cancelled while running the DPP shielded builder test:

dpp::shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance
Source: packages/rs-dpp/src/shielded/builder/mod.rs

Observed on dashpay/platform#3930 at head 663b50ab8357f8f01c624c6f6da9b812adfc8610:
https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766

Failure mode

The job had already completed formatting, clippy, unused-dependency checks, immutable-structure checks, and the non-shielded nextest run. During the serial shielded cargo test step, the log reached:

test shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance has been running for over 60 seconds
##[error]The operation was canceled.

There is no Rust panic/assertion failure in the log. The workflow continued through cleanup and Codecov upload, but GitHub marked the macOS Rust job cancelled/failed, leaving codecov/project red downstream.

Why this looks unrelated to the PR that exposed it

dashpay/platform#3930 changes keep-history/delete validation and fixtures. Its live PR file list does not touch packages/rs-dpp/src/shielded/builder/mod.rs or the shielded builder tests.

The affected job is a self-hosted macOS coverage path and the cancellation appears to be runner/job-budget behavior rather than a source regression from the PR diff.

Reproduction / investigation pointers

A focused local/runner check would be:

cargo test -p dpp --features all_features \
  shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance \
  -- --exact --nocapture

Also inspect whether the macOS Run shielded tests with cargo test (shared process for VK reuse) step has an external timeout or cancellation budget that can kill long proving tests after they exceed the runner's expected duration.

Additional CI evidence from tracker #1587 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
The job reached shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance, logged that it had been running for over 60 seconds, then GitHub cancelled it (##[error]The operation was canceled.).
The PR diff does not touch .github/workflows, Codecov/coverage configuration, or packages/rs-dpp/src/shielded/....
The codecov/project red status is consistent with incomplete/mismatched coverage uploads rather than patch coverage: GitHub reports codecov/patch success / all modified coverable lines covered, while codecov/project reports HEAD has fewer Rust uploads than base (rust: base 3, head 1).

Diagnosis remains: this is the existing macOS coverage/runtime-budget issue tracked here, not a source regression from PR #3930.

Additional duplicate CI evidence from tracker #1596 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
The log again shows the same failure mode already tracked here: shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance had been running for over 60 seconds, then GitHub cancelled the job with ##[error]The operation was canceled.
The PR diff remains limited to keep-history/delete validation paths and fixtures; it does not touch packages/rs-dpp/src/shielded/builder/mod.rs, the shielded builder tests, workflows, or Codecov configuration.
codecov/patch is green while codecov/project is red, consistent with partial/incomplete coverage from the cancelled macOS job rather than uncovered changed lines.

No new branch changes were made for PR #3930; diagnosis remains that this is the existing macOS coverage/runtime-budget issue tracked here.

Additional duplicate CI evidence from tracker #1598 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
The log shows the same existing failure mode: shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance had been running for over 60 seconds, followed by ##[error]The operation was canceled.
PR fix(platform): reject keep-history document deletes cleanly #3930 current diff is limited to keep-history document-delete validation and related fixtures/version wiring; it does not touch the shielded builder test, workflows, or Codecov configuration.
Codecov patch remains green while project coverage is red because HEAD has fewer Rust uploads than base (base 3, head 1), matching partial/incomplete coverage from the cancelled job.

No branch changes were made for PR #3930; diagnosis remains that this is the existing macOS coverage/runtime-budget issue tracked here.

Additional duplicate CI evidence from tracker #1614 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
Current diagnosis is unchanged: the job reached shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance, logged that it had been running for over 60 seconds, then GitHub cancelled it with ##[error]The operation was canceled.
PR fix(platform): reject keep-history document deletes cleanly #3930's diff remains limited to keep-history document-delete validation, fixtures, and version wiring; it does not touch the shielded builder test, workflows, or Codecov configuration.
codecov/patch remains green while codecov/project is red, consistent with incomplete/mismatched coverage uploads from the cancelled macOS run.

No new branch changes were made for PR #3930; this remains the existing macOS coverage/runtime-budget issue tracked here.

Additional duplicate CI evidence from tracker #1625 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
Current diagnosis is unchanged: the job reached shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance, logged that it had been running for over 60 seconds, then GitHub cancelled it with ##[error]The operation was canceled.
PR fix(platform): reject keep-history document deletes cleanly #3930 remains at 663b50ab8357f8f01c624c6f6da9b812adfc8610 on fix/document-history-delete-error; the PR diff does not touch the shielded builder test, workflows, or Codecov configuration.
codecov/patch remains green while codecov/project is red, consistent with incomplete/mismatched coverage uploads from the cancelled macOS run.

No new branch changes were made for PR #3930; this remains the existing macOS coverage/runtime-budget issue tracked here.

Additional duplicate CI evidence from tracker #1630 / PR #3930 recheck:

macOS Rust job: https://github.com/dashpay/platform/actions/runs/27865015258/job/82467557766
Current diagnosis is unchanged: the job reached shielded::builder::mod_tests::dummy_output_padding_action_count_and_value_balance, logged that it had been running for over 60 seconds, then GitHub cancelled it with ##[error]The operation was canceled.
The job cleanup later terminated the orphaned dpp test process, confirming the cancellation interrupted the same long-running shielded test process rather than a Rust assertion/panic.
PR fix(platform): reject keep-history document deletes cleanly #3930 remains at 663b50ab8357f8f01c624c6f6da9b812adfc8610; its diff is limited to keep-history document-delete validation, fixtures, and version wiring. It does not touch the shielded builder test, workflows, or Codecov configuration.
codecov/patch remains green while codecov/project is red, consistent with incomplete/mismatched coverage uploads from the cancelled macOS run.