Add zero-test guard after shard filtering and pin retry action to SHA

- Raise MFCException when --shard produces zero cases (prevents
  silent green CI with nothing executed)
- Pin nick-fields/retry to commit SHA for security on self-hosted
  runners with cluster credentials

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sbryngelson

.github/workflows/test.yml

@@ -254,7 +254,7 @@ jobs:
 
       - name: Build
         if:   matrix.cluster != 'phoenix'
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           max_attempts: 3
           retry_wait_seconds: 60

toolchain/mfc/test/test.py

@@ -140,6 +140,12 @@ def __filter(cases_) -> typing.List[TestCase]:
         skipped_cases += [c for i, c in enumerate(cases) if i % shard_count != shard_idx - 1]
         cases = [c for i, c in enumerate(cases) if i % shard_count == shard_idx - 1]
 
+        if not cases:
+            raise MFCException(
+                f"--shard {ARG('shard')} matched zero test cases. "
+                f"Total cases before sharding may be less than shard count."
+            )
+
     if ARG("percent") == 100:
         return cases, skipped_cases