ci: wire compat-test bundle from quantcli/common against crono-export

Adds the build-tag-gated `compat_contract_test.go` and a new CI
workflow that:

1. Builds the crono-export binary.
2. Resolves the github.com/quantcli/common/compat dependency via
   `go mod tidy` (the package itself is stdlib-only and hermetic).
3. Runs `go test -tags=compat -run TestContractDates ./...` against
   the built binary, with CRONO_EXPORT_BIN pointing at it.

A failing test here means crono drifted from CONTRACT §3 or §5.

**Stacked on quantcli/common#6** — the require line points at the
pseudo-version of that branch's HEAD commit, so the workflow only
goes green once #6 merges to main and the proxy reindexes. The
require version will be rebased onto a merged-main pseudo-version
(or a tagged release if we cut one) before flipping this PR ready.

Refs QUA-8.

Co-Authored-By: Paperclip <[email protected]>

Author: IntegrationStandards

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: go vet + test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: go vet
+        run: go vet ./...
+      - name: go test
+        run: go test ./...
+
+  compat:
+    name: compat (CONTRACT machine-attestation)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: resolve compat dependency
+        # The compat module lives at github.com/quantcli/common/compat
+        # under a subpath. `go mod tidy` materializes go.sum for it on
+        # first run; subsequent runs are cache-served.
+        run: go mod tidy
+      - name: build crono-export
+        run: go build -o /tmp/crono-export .
+      - name: run compat suite
+        env:
+          # Path the compat-tagged test reads from os.Getenv.
+          CRONO_EXPORT_BIN: /tmp/crono-export
+        run: go test -tags=compat -run TestContractDates ./...

compat_contract_test.go

@@ -0,0 +1,28 @@
+//go:build compat
+
+// Compat-test entry point for crono-export-cli.
+//
+// This file is only compiled under the `compat` build tag, so it does
+// not affect the default `go test ./...` run. CI invokes it as
+// `go test -tags=compat ./...` after building the export binary and
+// exposing its path through CRONO_EXPORT_BIN.
+//
+// The actual assertions live in github.com/quantcli/common/compat.
+// Drift between this CLI and CONTRACT.md surfaces as a failure here.
+package main_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/quantcli/common/compat"
+	"github.com/quantcli/common/compat/dates"
+)
+
+func TestContractDates(t *testing.T) {
+	bin := os.Getenv("CRONO_EXPORT_BIN")
+	if bin == "" {
+		t.Skip("CRONO_EXPORT_BIN not set; skipping compat suite")
+	}
+	dates.RunContract(t, compat.Runner{Binary: bin})
+}

go.mod

@@ -4,6 +4,7 @@ go 1.25.5
 
 require (
 	github.com/jrmycanady/gocronometer v1.5.1
+	github.com/quantcli/common/compat v0.0.0-20260510223424-1882283f6817
 	github.com/spf13/cobra v1.10.2
 )