feat(conformance): add versioned conformance suite and fix entitlement defects

.claude/commands/release.md

@@ -125,7 +125,12 @@ For a multi-package release train, use this order when affected:
 6. `release-godot.yml`
 7. `release-kmp.yml`
 8. `release-maui.yml`
-9. `npm run deploy`; run `release.yml` with `version=current` only when the
+9. `release-conformance.yml` — independent of the native/spec floor. Release it
+   when the behavior spec, runner, or adapter contract changed; skip it
+   otherwise. Its version is the conformance **suite** version, not the spec
+   version, so it does not participate in the `spec = min(google, apple)`
+   invariant.
+10. `npm run deploy`; run `release.yml` with `version=current` only when the
    native-derived `spec` advanced. If a Docs GitHub Release is requested while
    `spec` is unchanged, stop and explain that the immutable `docs-{spec}` tag
    cannot represent a new release.

.github/workflows/ci-kmp-iap.yml

@@ -78,8 +78,12 @@ jobs:
         with:
           cache-read-only: true
 
-      - name: Compile iOS simulator source set
+      # `iosSimulatorArm64Test` also compiles the source set, so this replaces
+      # the previous compile-only step rather than adding to it. Without it the
+      # iosTest suite (IosErrorMappingTest, IosConnectionLifecycleTest) never
+      # ran in CI.
+      - name: Compile and test iOS simulator source set
         run: |
           chmod +x gradlew
           "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" \
-            ./gradlew --no-parallel :library:compileKotlinIosSimulatorArm64
+            ./gradlew --no-parallel :library:iosSimulatorArm64Test

.github/workflows/ci.yml

@@ -85,6 +85,7 @@ jobs:
           filters: |
             gql:
               - 'packages/gql/**'
+              - 'packages/conformance/**'
               - 'scripts/**'
               - 'package.json'
               - 'bun.lock'
@@ -117,6 +118,56 @@ jobs:
               - 'package.json'
               - 'bun.lock'
               - '.github/workflows/ci.yml'
+  test-conformance:
+    name: Test Conformance Suite
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+
+      - name: Install dependencies
+        run: |
+          for i in 1 2 3; do
+            bun install --frozen-lockfile && break
+            [ $i -eq 3 ] && exit 1
+            echo "Attempt $i failed. Retrying..."
+            sleep 5
+          done
+
+      - name: Run conformance suite tests
+        working-directory: packages/conformance
+        run: bun run test
+
+      - name: Verify cross-language behavior ids are in sync
+        run: node packages/conformance/scripts/generate-behavior-ids.mjs --check
+
+      - name: Reference conformance report
+        run: node packages/conformance/scripts/run-reference-report.mjs
+
+      - name: Ecosystem coverage report
+        run: |
+          node packages/conformance/scripts/coverage-report.mjs
+          node packages/conformance/scripts/coverage-report.mjs --json > conformance-coverage.json
+          node packages/conformance/scripts/run-reference-report.mjs --json > conformance-report.json
+
+      - name: Upload conformance report
+        uses: actions/upload-artifact@v4
+        with:
+          name: conformance-report
+          path: |
+            conformance-report.json
+            conformance-coverage.json
+          if-no-files-found: error
+
   audit-parity:
     name: Audit SDK Parity
     runs-on: ubuntu-latest