Replaces the repeated inline cargo-nextest install steps in CI with a shared composite action that caches the pinned binary and verifies the downloaded archive by checksum before extracting. Warm jobs that already have the binary for the same version, runner OS, and arch skip the download entirely.
Hardening
Downloads retry failed transfers, the archive checksum is verified before extraction, and the installed binary version is checked afterwards.
tar extracts from $RUNNER_TEMP using relative archive paths so Windows drive-letter paths are handled safely.
The pyright npm install now retries transient registry errors.
New CI gate tests require a single shared installer: no curl/wget-to-tar piping, and every workflow site must use setup-nextest.
Confidence Score: 5/5
The PR appears safe to merge.
Summary
Shares a cached, checksum-checked cargo-nextest installer across CI jobs.
Rust test jobs share a cached, verified cargo-nextest setup.
Linux integration shards retry Pyright package downloads.
