test: exercise native Android flows against pinned upstream HTTPS and OIDC

Add an ephemeral HTTPS proxy and standards-shaped RS256/S256-PKCE test IdP around the unmodified upstream checkout. Require unlocked devices and nonempty, failure-free JUnit evidence. The extended API 35 suite passes all seven cases, including native Blob/file transfer, session recreation, outage recovery, isolated OIDC and back navigation; eight evidence-verifier regressions also pass. API 37 and real-provider/device validation remain release gates.

scripts/test-verifier.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Regression tests for fail-closed JUnit evidence verification."""
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+VERIFIER = Path(__file__).with_name("verify-test-results.py")
+
+
+class EvidenceVerifierTests(unittest.TestCase):
+    def verify(self, xml=None, minimum=1):
+        with tempfile.TemporaryDirectory(prefix="yuvomi-evidence-") as temporary:
+            if xml is not None:
+                (Path(temporary) / "TEST-fixture.xml").write_text(xml)
+            return subprocess.run(
+                [sys.executable, str(VERIFIER), temporary, "--minimum", str(minimum)],
+                capture_output=True, text=True,
+            ).returncode
+
+    def test_missing_reports_fail(self):
+        self.assertNotEqual(self.verify(), 0)
+
+    def test_empty_reports_fail(self):
+        self.assertNotEqual(self.verify("<testsuite/>"), 0)
+
+    def test_malformed_reports_fail(self):
+        self.assertNotEqual(self.verify("<testsuite>"), 0)
+
+    def test_failed_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><failure/></testcase></testsuite>"), 0)
+
+    def test_errored_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><error/></testcase></testsuite>"), 0)
+
+    def test_skipped_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase><skipped/></testcase></testsuite>"), 0)
+
+    def test_insufficient_cases_fail(self):
+        self.assertNotEqual(self.verify("<testsuite><testcase/></testsuite>", minimum=2), 0)
+
+    def test_passing_cases_succeed(self):
+        self.assertEqual(self.verify("<testsuite><testcase/></testsuite>"), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()