Cucumber concurrency validation plus fix (#7379)

# Description of Changes

cucumber tests to run multiple threads of commands at same time 

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

.github/workflows/nightly.yml

@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: "0 2 * * *" # 2 AM UTC every night
   workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/nightly.yml
+      - testing/cucumber/**
+      - docker/embedded/compose/test_cicd.yml
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -99,8 +104,13 @@ jobs:
 
   # Builds all desktop platforms on a schedule so the Rust dependency cache is
   # written on main, where PR and merge-queue tauri builds can restore it.
+  #
+  # The only job here still pinned to schedule/main: it primes a cache rather than
+  # testing anything, and Actions scopes a cache written on a PR branch to that PR
+  # alone, so a PR run costs three platform builds and produces nothing reusable.
   warm-tauri-cache:
     name: Warm Tauri Rust cache
+    if: github.event_name == 'schedule' || github.ref == 'refs/heads/main'
     permissions:
       contents: read
       pull-requests: write
@@ -109,3 +119,72 @@ jobs:
       platform: all
       sign: false
     secrets: inherit
+
+  # Runs the @nightly tag (conversion scenarios) plus a 10-shard concurrency run
+  # of every other feature.
+  cucumber-nightly:
+    name: Cucumber (nightly scenarios + full concurrency)
+    runs-on: ubuntu-latest
+    # Fork pull requests get no MAVEN_* secrets, so the image build cannot work.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            engine/pyproject.toml
+            engine/uv.lock
+
+      - name: Install Task
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
+      - name: Start the fat image with login and storage enabled
+        run: docker compose -f docker/embedded/compose/test_cicd.yml up -d --build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Wait for the server
+        # Throwaway key from test_cicd.yml; out of the header literal for gitleaks.
+        env:
+          TEST_API_KEY: "123456789"
+        run: |
+          curl --retry 90 --retry-delay 3 --retry-connrefused --retry-all-errors \
+            -sf -H "X-API-KEY: $TEST_API_KEY" http://localhost:8080/api/v1/info/status
+
+      # Heavy LibreOffice/Calibre/Ghostscript conversions, excluded from the PR run.
+      # Both tasks install the behave deps themselves, so there is no separate uv sync step.
+      - name: Run @nightly scenarios
+        run: task cucumber:nightly
+
+      # Genuinely different payloads contending on one backend.
+      - name: Sharded concurrency validation
+        run: task cucumber:parallel SHARDS=10
+
+      - name: Container logs on failure
+        if: failure()
+        run: docker compose -f docker/embedded/compose/test_cicd.yml logs --tail 400
+
+      - name: Tear down
+        if: always()
+        run: docker compose -f docker/embedded/compose/test_cicd.yml down -v