feat(auth): validate opaque checksum keys and canonical client strings

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- What changes for a caller? Keep this short. No feature-impact tables. -->
+
+## Verification
+
+<!-- Relevant checks and demo/evidence link. State material gaps. -->
+
+## Release status
+
+<!-- Availability or required publication/deployment gate, when applicable. -->

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ jobs:
         node-version: [20, 22]
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
@@ -28,9 +30,17 @@ jobs:
       - run: npm run typecheck
       - run: npm run build:workspaces
       - run: npm test
-      - run: node --test scripts/release-gate.test.mjs scripts/sync-linear-coverage.test.mjs
+      - run: node --test scripts/release-gate.test.mjs scripts/native-release.test.mjs scripts/native-publish.test.mjs scripts/sync-linear-coverage.test.mjs
+      - run: node --test scripts/sdk-fixture-server.test.mjs scripts/multi-language-coverage.test.mjs examples/calls-example/server-credential.test.mjs
+      - run: python3 scripts/inspect-native-artifacts.test.py
+      - run: python3 scripts/prepare-php-mirror.test.py
       - run: npm run build
+      - run: npm run check:doc-snippets
+      - run: npm run test:doc-snippets
+      - run: npm run verify:doc-snippets -- typescript --negative-test
+      - run: npm run check:machine-credentials
       - run: npm run check:coverage
+      - run: node scripts/check-native-coverage.mjs
       - run: npm run check:functions
       - run: npm run check:names
       - run: npm pack --dry-run --workspaces --ignore-scripts