proto: wire the conformance suite into ctest so CI actually runs it

Verified PKG's landed CI (.github/workflows/ci.yml, db7650b/8f45815) against
this lane's actual tree, per the standing instruction that conformance as a
required check is this lane's DoD to verify, not PKG's. It wasn't running:
the `conformance` job's presence-check looks for tests/conformance/CMakeLists.txt
or tests/conformance/package.json, and neither existed -- the job was
silently short-circuiting to a green "skipped" on every PR, forever. The M0
exit gate was not gating anything.

tests/conformance/CMakeLists.txt registers one ctest entry, labeled
"conformance", that shells out to run.sh -- the exact command
tests/conformance/README.md tells a human to run locally, so there is one
definition of "the suite passed", not a CMake-flavoured near-duplicate of it.
cpp/CMakeLists.txt's existing conformance_cpp test gets the same label, for a
lane iterating on core/generated/ who wants the fast native-only path.

Fixed a second landmine found while wiring this: the root CMakeLists.txt only
find_package(nlohmann_json)'s when daemon/CMakeLists.txt exists, since
daemon is its real consumer -- but daemon hasn't landed yet, so
add_subdirectory(tests/conformance) would have failed to configure the
moment this file existed, on every machine, until daemon merges. Fixed inside
tests/conformance/cpp/CMakeLists.txt with an if(NOT TARGET) guard rather than
widening the root file's condition, which is PKG's to change.

run.sh now installs its own Python deps (jsonschema, referencing) on demand:
they aren't in tools/bootstrap.sh's apt list -- that's PKG's script, these
are this suite's own dependency -- so a bare CI image would otherwise fail
check_contract.py with an ImportError before this suite even started.

Verified end to end: `cmake --preset dev && ctest --test-dir build/dev -R
'^conformance$'` passes in 23.8s, exercising the exact command and label the
CI job uses.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012fgjnqFCS5h5L7gZTZo3rV

tests/conformance/CMakeLists.txt

@@ -0,0 +1,26 @@
+# Wires the conformance suite into ctest, so `ctest -L conformance` — the check
+# .github/workflows/ci.yml's `conformance` job runs, and the one BRANCH_PROTECTION.md
+# names as required "when tests/conformance/ lands" — actually runs it. Without this file
+# that job's presence-check finds neither a CMakeLists.txt nor a package.json here and
+# silently no-ops to a green "skipped", forever: the M0 exit gate would never actually
+# gate anything. Owned by lane PROTO.
+#
+# One ctest entry shells out to run.sh — the exact command tests/conformance/README.md
+# tells a human to run locally. That is deliberate: there is exactly one definition of
+# "the suite passed", not a CMake-flavoured near-duplicate of it that can drift from the
+# real one. The native (C++) half also gets its own finer-grained test via add_subdirectory
+# below, for a lane iterating on core/generated/ who doesn't want npm's cost every run.
+
+add_subdirectory(cpp)
+
+add_test(
+    NAME conformance
+    COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/run.sh
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+)
+set_tests_properties(conformance PROPERTIES
+    LABELS "conformance"
+    # Installs two npm trees and runs a ten-minute-capable suite end to end; generous but
+    # not unbounded, so a genuinely hung mockd fails the job instead of the runner.
+    TIMEOUT 600
+)

tests/conformance/cpp/CMakeLists.txt

@@ -4,6 +4,14 @@
 # this exercises the wire types, which is a separate concern from the engine. See
 # docs/adr/0009-generated-protocol-library.md.
 
+# The root CMakeLists.txt only find_package(nlohmann_json)'s when daemon/CMakeLists.txt
+# exists (daemon is its real consumer), so this target may not exist yet when this
+# directory configures on its own — this suite must not depend on daemon having landed.
+# Self-sufficient rather than reaching into the root file to widen that guard.
+if(NOT TARGET nlohmann_json::nlohmann_json)
+    find_package(nlohmann_json 3.11 REQUIRED)
+endif()
+
 add_executable(velox_conformance_cpp
     conformance_main.cpp
     ${CMAKE_SOURCE_DIR}/core/generated/velox_proto.cpp)
@@ -18,3 +26,4 @@ target_link_libraries(velox_conformance_cpp PRIVATE nlohmann_json::nlohmann_json
 # The runner needs the repository root so it can find contracts/fixtures.
 add_test(NAME conformance_cpp
          COMMAND velox_conformance_cpp ${CMAKE_SOURCE_DIR})
+set_tests_properties(conformance_cpp PROPERTIES LABELS "conformance")

tests/conformance/run.sh

@@ -54,6 +54,12 @@ step() { printf '\n=== %s ===\n' "$1"; }
 
 # ---------------------------------------------------------------- 1. static
 step "static conformance (schemas, fixtures, generated code)"
+# jsonschema/referencing aren't part of tools/bootstrap.sh's apt list (that's PKG's
+# script; these are this suite's own Python deps), so this suite installs them itself
+# rather than assuming a CI image happens to have them. Cheap and idempotent when
+# they're already present, which is every local dev run after the first.
+python3 -c "import jsonschema, referencing" 2>/dev/null \
+  || python3 -m pip install --quiet --disable-pip-version-check --user jsonschema referencing
 python3 "$HERE/check_contract.py"
 
 # ------------------------------------------------------------------- 2. C++