ci: keep one install test, the one that matches how images are built

The two install workflows differed in a name, one env key and the script they
ran, and the orchestrator wired each separately. They become one file.

The pkgmgr half goes with them. Installing through the package manager is no
longer the plan, and the images have already moved: since the switch to
base-images every container is built FROM base-<distro>, so that test was the
last thing still pulling a pkgmgr image. The pkgmgr CLI itself is untouched;
roles keep calling it.

The mermaid graph in .github/workflows/README.md named both files as nodes and
as edges, which test_workflow_references caught after the rename. The workflow
table in the docs follows.

Verified: actionlint accepts every workflow, and 263 tests pass across
tests/lint/repository, tests/lint/filesystem and tests/integration/meta/workflows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/README.md

@@ -45,14 +45,12 @@ flowchart TB
         chunk0 --> smoke["call-test-runner-smoke.yml"]
         chain --> report["report-main-failures"]
 
-        instmake["call-test-install-make.yml"]
-        instpkgmgr["call-test-install-pkgmgr.yml"]
+        install["call-test-install.yml"]
         mirror --> devenv["test-workspace: call-test-workspace.yml"]
 
         chain --> donegate["done"]
         smoke --> donegate
-        instmake --> donegate
-        instpkgmgr --> donegate
+        install --> donegate
         devenv --> donegate
     end
 

.github/workflows/call-orchestrator.yml

@@ -309,12 +309,9 @@ jobs:
       ref: ${{ github.sha }}
     secrets: inherit
 
-  test-install-make:
+  test-install:
     needs: validate-selection
-    uses: ./.github/workflows/call-test-install-make.yml
-  test-install-pkgmgr:
-    needs: validate-selection
-    uses: ./.github/workflows/call-test-install-pkgmgr.yml
+    uses: ./.github/workflows/call-test-install.yml
 
   test-workspace:
     if: ${{ inputs.workspace == 'true' || (inputs.workspace == 'auto' && (inputs.whitelist == '' || inputs.whitelist == '__ALL__')) }}
@@ -354,8 +351,7 @@ jobs:
       - build-ci-images
       - images-mirror-missing
       - test-dns
-      - test-install-make
-      - test-install-pkgmgr
+      - test-install
       - test-deploy-chunk-0
       - test-deploy-chunk-1
       - test-deploy-chunk-2

.github/workflows/call-test-install-pkgmgr.yml

@@ -1,30 +0,0 @@
-name: "📦 Test: Install Package Manager"
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  packages: read
-
-jobs:
-  test-install-pkgmgr:
-    name: 📦 PKGMGR
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      NIX_CONFIG: |
-        access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-
-    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@v7.0.0
-
-      - name: 🔍 Resolve INFINITO_VENV_DIR from default.env
-        run: |
-          venv_dir="$(awk -F= '/^INFINITO_VENV_DIR=/{print $2; exit}' default.env)"
-          test -n "${venv_dir}" || { echo "INFINITO_VENV_DIR not found in default.env" >&2; exit 1; }
-          echo "INFINITO_VENV_DIR=${venv_dir}" >> "$GITHUB_ENV"
-
-      - name: 📦 Install & test in every pkgmgr virgin container (parallel)
-        run: ./scripts/tests/install/pkgmgr.sh

.github/workflows/call-test-install.yml

@@ -1,4 +1,4 @@
-name: "📦 Test: Install Make"
+name: "📦 Test: Install"
 
 on:
   workflow_call:
@@ -8,7 +8,7 @@ permissions:
   packages: read
 
 jobs:
-  test-install-make:
+  test-install:
     name: 🛠️ Makefile
     runs-on: ubuntu-latest
     timeout-minutes: 30

docs/contributing/tools/github/actions/workflows.md

@@ -72,8 +72,7 @@ Trigger column legend: **auto** = fires automatically (push, pull_request, sched
 |---|---|---|---|
 | [call-test-dns.yml](../../../../../.github/workflows/call-test-dns.yml): `💬 Test: DNS` | Validates DNS resolution across target distributions. | reusable, manual | `distros` (required on call; default `debian` on manual) |
 | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml): `🚀 Test: Deploy` | Deploys one chunk of the sweep. Every matrix row is a single `role#variant` carrying the deploy mode, onion state, distro and filesystem the rotation assigned it: `swarm` rows get a simulated 3-node DinD cluster with an NFS server plus a drain/reschedule state-survival assertion, `compose` and `host` rows run the single-node drill. When `whitelist` is empty, the discover job derives one from the branch's diff vs `origin/main`; see the "Diff-driven app selection" subsection in [pipeline.md](../../../artefact/git/pipeline.md). A row marked 📖 -- the role's smallest variant, see [instructions.md](instructions.md) -- replays the role README's `### Production` block on the same runner once the deploy has released it. | reusable | `index`, `sweep` (required), `distros` (optional pool), `filesystem` (optional pool), `whitelist` (optional; explicit value wins over diff), `priority`, `lifecycles`, `modes` (default `auto`), `tor`, `marker` |
-| [call-test-install-make.yml](../../../../../.github/workflows/call-test-install-make.yml): `📥 Test: Install Make` | Validates the `make install` entry points. | reusable | none |
-| [call-test-install-pkgmgr.yml](../../../../../.github/workflows/call-test-install-pkgmgr.yml): `📥 Test: Install Package Manager` | Validates installation via the upstream package manager. | reusable | none |
+| [call-test-install.yml](../../../../../.github/workflows/call-test-install.yml): `📦 Test: Install` | Validates the `make install` entry points in every distribution base container. | reusable | none |
 | [call-test-workspace.yml](../../../../../.github/workflows/call-test-workspace.yml): `💻 Test: Workspace` | Builds and exercises the dev-runtime image matrix. | reusable, manual | none |
 
 ### Release and maintenance 🚀🔄

scripts/tests/install/pkgmgr.sh

@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-#
-# Install & test Infinito via pkgmgr in every distro's virgin container,
-# all distros in parallel inside a single CI job (one runner instead of a
-# matrix). Each distro gets its own copy of the checkout so the concurrent
-# in-container installs never race on the shared working tree.
-#
-# Inputs via env:
-#   NIX_CONFIG          nix access-tokens block (job env).
-#   INFINITO_VENV_DIR   venv path inside the container (from default.env).
-#   RUNNER_TEMP         runner scratch dir for the per-distro copies.
-#   GITHUB_WORKSPACE    the checkout to install and test.
-#
-# The distro set comes from INFINITO_DISTROS, which the env layer generates
-# from the meta/distros.yml SPOT.
-
-set -uo pipefail
-
-: "${NIX_CONFIG:?}"
-: "${INFINITO_VENV_DIR:?}"
-: "${RUNNER_TEMP:?}"
-: "${GITHUB_WORKSPACE:?}"
-
-# shellcheck source=scripts/meta/env/load.sh
-source "${GITHUB_WORKSPACE}/scripts/meta/env/load.sh"
-: "${INFINITO_DISTROS:?INFINITO_DISTROS must be resolved by scripts/meta/env/load.sh}"
-read -r -a distros <<<"${INFINITO_DISTROS}"
-declare -A pid
-
-for d in "${distros[@]}"; do
-	src="${RUNNER_TEMP}/src-${d}"
-	cp -a "${GITHUB_WORKSPACE}/." "${src}"
-	docker run --rm \
-		-w "/root/" \
-		-e NIX_CONFIG="${NIX_CONFIG}" \
-		-e INFINITO_VENV_DIR="${INFINITO_VENV_DIR}" \
-		-v "${src}:/root/Repositories/github.com/kevinveenbirkenbach/infinito-nexus" \
-		"ghcr.io/kevinveenbirkenbach/pkgmgr-${d}:latest" \
-		bash -lc '
-			set -euo pipefail
-			make -C "/root/Repositories/github.com/kevinveenbirkenbach/infinito-nexus" install-system-python
-			pkgmgr install infinito --clone-mode shallow --no-verification
-			source "${INFINITO_VENV_DIR}/bin/activate"
-			infinito --help
-		' >"/tmp/install-${d}.log" 2>&1 &
-	pid["${d}"]=$!
-done
-
-rc_total=0
-for d in "${distros[@]}"; do
-	rc=0
-	wait "${pid[${d}]}" || rc=$?
-	echo "::group::${d} (exit ${rc})"
-	cat "/tmp/install-${d}.log"
-	echo "::endgroup::"
-	if [[ "${rc}" -ne 0 ]]; then
-		echo "::error::pkgmgr install failed for ${d}"
-		rc_total=1
-	fi
-done
-
-exit "${rc_total}"