Why use a Shamir architecture at all, instead of giving the CI run an ephemeral token that will be exchanged on the proxy?
The difference with Shamir is what happens if the proxy itself is compromised. With token exchange the proxy holds or can reconstruct the real key server side. A compromised proxy is game over for the credential.