pkg: make the conformance CI check run and be able to fail

The conformance job was a required check that ran nothing. Two bugs:

  1. Its guard tested for tests/conformance/CMakeLists.txt or package.json.
     The suite ships as tests/conformance/run.sh; neither file exists, so the
     guard was always false and the job took the "skipped" (success) branch.
  2. Even forced true, it ran `ctest --preset dev -L conformance` — no test
     carries that label, so ctest reported "Total Tests: 0" and exited 0.

Replace the job body with PROTO's intended wiring from
tests/conformance/README.md: bootstrap the toolchain, pin Node 22 (apt ships
< 20; the TS replay runner needs >= 20), and run ./tests/conformance/run.sh
directly. The suite starts its own mockd and builds its own C++ runner, so no
cmake configure is needed. Verified it goes red: an enum-invalid fixture makes
run.sh exit 1; reverting it returns to green.

check_contract.py imports jsonschema and referencing, which bootstrap.sh did
not install. Add python3-jsonschema / python3-referencing to the apt set and
to --check, so one command still provisions the whole suite.

Guards now fail loudly instead of passing quietly:

  - conformance has no skip branch any more. run.sh has landed; the job runs
    it unconditionally and errors if the entrypoint is missing.
  - extension-lint keyed "has EXT landed?" to extension/package.json — the
    same single-filename trap. Key it to a manifest instead, and once a
    manifest exists, treat a missing package.json as a hard failure rather
    than a green skip.

Mark conformance required now in BRANCH_PROTECTION.md — it is the M0 exit gate.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw

tools/bootstrap.sh

@@ -97,6 +97,11 @@ APT_NODE=(
     npm
 )
 
+APT_PYTHON=(
+    python3-jsonschema         # tests/conformance: check_contract.py schema validation
+    python3-referencing        # tests/conformance: $ref registry for draft 2020-12
+)
+
 APT_CLANG=(
     clang                      # optional: libFuzzer targets (M7)
     llvm
@@ -112,7 +117,7 @@ APT_PACKAGING=(
 
 # --- install --------------------------------------------------------------------
 
-PKGS=("${APT_CORE[@]}" "${APT_LIBS[@]}" "${APT_GUI[@]}" "${APT_LINT[@]}" "${APT_NODE[@]}")
+PKGS=("${APT_CORE[@]}" "${APT_LIBS[@]}" "${APT_GUI[@]}" "${APT_LINT[@]}" "${APT_NODE[@]}" "${APT_PYTHON[@]}")
 [[ $WITH_CLANG -eq 1 ]]     && PKGS+=("${APT_CLANG[@]}")
 [[ $WITH_PACKAGING -eq 1 ]] && PKGS+=("${APT_PACKAGING[@]}")
 
@@ -191,6 +196,19 @@ if command -v node >/dev/null 2>&1; then
     fi
 fi
 
+# Python modules the conformance suite's static runner imports directly.
+if command -v python3 >/dev/null 2>&1; then
+    for mod in jsonschema referencing; do
+        if python3 -c "import $mod" 2>/dev/null; then
+            printf '  \033[32m✓\033[0m %-16s %s\n' "py:$mod" \
+                "$(python3 -c "import importlib.metadata as m; print(m.version('$mod'))" 2>/dev/null)"
+        else
+            printf '  \033[31m✗\033[0m %-16s python3 can'\''t import it\n' "py:$mod"
+            fail=1
+        fi
+    done
+fi
+
 # Qt / library dev packages: check via pkg-config where possible.
 for mod in Qt6Core Qt6Widgets Qt6Svg libcurl sqlite3 libssl libsecret-1 libavformat; do
     if pkg-config --exists "$mod" 2>/dev/null; then