ci: isolate long GRM recovery from bounded ignored-test shards

.github/workflows/statistical-studies.yml

@@ -40,6 +40,7 @@ jobs:
           --skip mlsirm-core/test/literature_true_parameter_recovery::kang_jeon_2025_minimum_cell_recovers_true_parameters
           --skip mlsirm-core/test/literature_true_parameter_recovery::gpu_recovery_matches_cpu_on_paper_design
           --skip mlsirm-core/test/higher_order_mc_recovery::higher_order_dina_recovery_respects_monte_carlo_tolerance
+          --skip mlsirm-core/lib/mlsirm_core::grm::tests::mc_grm_recovery_500
 
   rust-pyo3-ignored:
     name: Ignored PyO3 studies
@@ -70,6 +71,21 @@ jobs:
           higher_order_dina_recovery_respects_monte_carlo_tolerance
           -- --ignored --exact --nocapture
 
+  grm-recovery:
+    name: GRM 500-rep recovery study
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+      - name: Run multidimensional GRM Monte Carlo recovery
+        run: >-
+          cargo test --release -p mlsirm-core --lib
+          grm::tests::mc_grm_recovery_500
+          -- --ignored --exact --nocapture --test-threads=1
+
   gpu-recovery:
     name: Literature GPU recovery parity
     runs-on: ubuntu-latest

tests/test_statistical_studies_workflow.py

@@ -32,6 +32,7 @@ def test_exhaustive_studies_are_scheduled_manual_and_release_triggered():
     assert "rust-ignored:" in text
     assert "rust-pyo3-ignored:" in text
     assert "rust-recovery:" in text
+    assert "grm-recovery:" in text
     assert "gpu-recovery:" in text
 
 
@@ -45,6 +46,15 @@ def test_statistical_studies_are_read_only_and_never_rewrite_source():
     assert "--exact" in text
 
 
+def test_grm_recovery_checkout_does_not_persist_credentials():
+    """The dedicated GRM study keeps checkout credentials away from Rust tests."""
+    text = _STUDIES.read_text(encoding="utf-8")
+    _, grm_block = text.split("\n  grm-recovery:\n", maxsplit=1)
+    grm_block, _ = grm_block.split("\n  gpu-recovery:\n", maxsplit=1)
+    assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in grm_block
+    assert "persist-credentials: false" in grm_block
+
+
 def test_general_and_pyo3_jobs_follow_the_declared_workspace_boundary():
     """The general inventory uses workspace metadata; excluded PyO3 is separate."""
     workflow = _STUDIES.read_text(encoding="utf-8")
@@ -72,11 +82,13 @@ def test_dedicated_study_exclusions_are_target_qualified_and_executed_elsewhere(
         "gpu_recovery_matches_cpu_on_paper_design",
         "mlsirm-core/test/higher_order_mc_recovery::"
         "higher_order_dina_recovery_respects_monte_carlo_tolerance",
+        "mlsirm-core/lib/mlsirm_core::grm::tests::mc_grm_recovery_500",
     )
     raw_names = (
         "kang_jeon_2025_minimum_cell_recovers_true_parameters",
         "gpu_recovery_matches_cpu_on_paper_design",
         "higher_order_dina_recovery_respects_monte_carlo_tolerance",
+        "mc_grm_recovery_500",
     )
     for identifier in identifiers:
         assert f"--skip {identifier}" in text