[Ariznawlll]

Scope

Replace x86 UT Coverage's TKE runner with the shared cs-large-7c14g pool. No manual environment selection: the actual runner selects MTY, MNL2, JED or RUH S3, and the whole Coverage job stays on that runner.

• Require all four CS_S3_*_CONFIG secrets before enabling the pool. Unknown runners or missing matching configuration fail; no cross-environment fallback.
• Preserve normal PR source selection and organization-member / safe to test trust checks, package parallelism 8, package/suite deadlines and coverage reporting.
• Use restricted CI-bucket credentials and ci-ut/<run-id>-<attempt>/ isolation. Requires MatrixOne #32590, whose fixtures clean only their own objects.
• Require real CS S3 basic and streaming-write tests to pass. COS/OSS integrations are intentionally outside the agreed UT scope.
• Keep redacted skip evidence and same-source comparison: accept existing skips, reject new skipped identities, failures, timeouts or mismatched package scope. This is an explicit artifact comparison, not automatic baseline discovery.

Simplification

Removed fixed-PR/SHA canaries, test-branch bypasses, temporary runner/parallelism inputs, local MinIO build/experiment logic and legacy cloud credential branches. Shortened documentation and retained only production-path contract tests. Existing unrelated cache inputs remain unchanged.

Validation

• 25 local routing, isolation, mandatory-S3-pass, skip comparison, report and timeout-runner tests passed.
• Whole-repository actionlint and git diff --check passed.
• Historical same-source TKE/JED manifests still reject the failed producer even with zero added skips.
• GitHub Linux workflow/contract validation passed for commit 8ceb5f6: workflow schema/actionlint, native runtime, CS routing/isolation, mandatory S3 execution and skip comparison checks.
• Earlier four-environment signed S3 smoke and JED full Coverage passed; these predate this cleanup and do not establish all-environment rollout readiness.

Rollout gate — keep draft

Merge the MO fixtures first and finish same-source full Coverage / added-skip acceptance in all four environments before switching production. This cleanup does not merge main, change runner capacity, restart existing tests or touch stored data.

[Ariznawlll]

已补充 CS S3 接入合约测试和 JED 内部 endpoint 部署说明（a414b3e）。CS 路径按 runner 环境选择对应 secret；受信任 PR 配置不全时明确失败；真实 COS/OSS 不注入 CS 日常 UT；强制核对 CS S3 basic 和 streaming_write 实际 pass。修复 secret-free local MinIO canary 仍错误要求云凭证的检查。本地 13 项 Python 测试和 actionlint 通过；最新 Linux 合约及隔离读写清理验证运行于 https://github.com/matrixorigin/matrixone/actions/runs/43149448772 。依赖 matrixorigin/matrixone#32590；真实 S3 配置和验证未完成，保持 draft，不切换 main 或现有正式测试。