test: exercise native Android flows against pinned upstream HTTPS and OIDC

Add an ephemeral HTTPS proxy and standards-shaped RS256/S256-PKCE test IdP around the unmodified upstream checkout. Require unlocked devices and nonempty, failure-free JUnit evidence. The extended API 35 suite passes all seven cases, including native Blob/file transfer, session recreation, outage recovery, isolated OIDC and back navigation; eight evidence-verifier regressions also pass. API 37 and real-provider/device validation remain release gates.

scripts/verify-test-results.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Require real, nonempty JUnit results; a build tool's zero exit is insufficient."""
+import argparse
+from pathlib import Path
+import xml.etree.ElementTree as ET
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("directory", type=Path)
+parser.add_argument("--minimum", type=int, required=True)
+arguments = parser.parse_args()
+cases = []
+for path in arguments.directory.rglob("TEST*.xml"):
+    cases.extend(ET.parse(path).getroot().iter("testcase"))
+failed = sum(case.find("failure") is not None or case.find("error") is not None for case in cases)
+skipped = sum(case.find("skipped") is not None for case in cases)
+print(f"JUnit evidence: {len(cases)} tests, {failed} failures/errors, {skipped} skipped")
+if len(cases) < arguments.minimum or failed or skipped:
+    raise SystemExit("Incomplete or failing test evidence; do not report this run as passing.")