CI: add cross-port byte-exact interop checks

[kduma]

Follow-up to #10 — adds the two safeguards I sketched in the PR-merge debrief.

(1) Rust workspace test — reference/PCF-SIG-v1.0/tests/cross_port_testdata.rs

Runs as part of cargo test --workspace. Compiles the reference vector via include_bytes! and asserts that the copies shipped by the .NET, PHP and TypeScript ports are byte-identical.

Catches: someone regenerates reference/PCF-SIG-v1.0/testdata/canonical.bin but forgets to propagate it to one or more ports.

Cost: one file read each, runs in <1 ms. No new toolchains.

$ cargo test -p pcf-sig --test cross_port_testdata
running 4 tests
test reference_has_canonical_length ... ok
test typescript_port_testdata_matches_reference ... ok
test php_port_testdata_matches_reference ... ok
test dotnet_port_testdata_matches_reference ... ok

(2) New workflow — .github/workflows/cross-port-interop.yml

Installs Rust + Node 22 + PHP 8.3 + .NET 8 in a single Ubuntu job, generates the canonical vector from each writer to a fresh path, and asserts:

• every output's SHA-256 matches the spec-pinned b158e2f5…1307
• every pair of outputs is cmp-equal byte-for-byte

Catches: writer-side drift that the per-port suites would miss if a port's testdata happened to match its (also drifted) writer.

The .NET case builds a tiny disposable CLI on the fly that calls SignPartitions.Run and writes CompactedImage() to a path — the .NET port doesn't ship a standalone gen-testvector example like the other three.

Triggered on changes that touch any pcf-sig directory or the workflow itself.

Why both

(1) is cheap and catches the common case (testdata desync). (2) is the actual interop guarantee — it proves all four writers produce identical bytes from the same deterministic seed, which is the central PCF-SIG cross-port property. Without (2), a writer regression could land if its committed testdata silently drifted with it.

Test plan

• cargo test -p pcf-sig --test cross_port_testdata passes locally (4/4)
• cross-port-interop workflow goes green on this PR
• no regression on existing CI matrix (cargo workspace test, dotnet-ci, php, ts-ci)

https://claude.ai/code/session_01ST4PcjqvobURus32WuyEi5

---

Generated by Claude Code