Add compatibility matrix fixture execution

Run package test jobs across every selected provider combination with isolated lane state, released-image canaries, controlled OIDC DNS, and deterministic cleanup.

tests/kind/lib-test.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+source "$ROOT/tests/kind/lib.sh"
+
+assert_matrix() {
+  local expected="$1"
+  shift
+  local actual
+  actual="$(expand_fixture_matrix "$@")"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'unexpected matrix for %s\nexpected:\n%s\nactual:\n%s\n' "$*" "$expected" "$actual" >&2
+    return 1
+  fi
+}
+
+assert_matrix $'001\t-\t-\t-' durable
+assert_matrix $'001\tredis\t-\t-\n002\tdragonfly\t-\t-' coordination
+assert_matrix $'001\t-\tkeycloak\tgarage\n002\t-\tkeycloak\tversitygw\n003\t-\tzitadel\tgarage\n004\t-\tzitadel\tversitygw' oidc target
+assert_matrix $'001\tredis\tkeycloak\tgarage\n002\tredis\tkeycloak\tversitygw\n003\tredis\tzitadel\tgarage\n004\tredis\tzitadel\tversitygw\n005\tdragonfly\tkeycloak\tgarage\n006\tdragonfly\tkeycloak\tversitygw\n007\tdragonfly\tzitadel\tgarage\n008\tdragonfly\tzitadel\tversitygw' all
+
+if expand_fixture_matrix redis >/dev/null 2>&1; then
+  printf 'individual provider selector was accepted\n' >&2
+  exit 1
+fi
+if expand_fixture_matrix all redis >/dev/null 2>&1; then
+  printf 'individual provider selector alongside all was accepted\n' >&2
+  exit 1
+fi
+
+select_fixture_families target durable target
+if [[ "${FIXTURE_FAMILIES[*]}" != "durable target" ]]; then
+  printf 'families were not normalized: %s\n' "${FIXTURE_FAMILIES[*]}" >&2
+  exit 1
+fi
+
+kube() {
+  return 1
+}
+select_fixture_families durable
+if write_lane_profile 001 - - - >/dev/null 2>&1; then
+  printf 'lane provisioning failure was ignored\n' >&2
+  exit 1
+fi
+
+write_lane_profile() {
+  printf 'remora-fixture-lane-001\n'
+}
+render_lane_job() {
+  return 0
+}
+run_job_manifest() {
+  return 42
+}
+cleanup_called=false
+cleanup_lane_state() {
+  cleanup_called=true
+}
+if run_job_matrix fixture-consumer /dev/null remora-test:local durable; then
+  printf 'Job failure was ignored\n' >&2
+  exit 1
+fi
+if [[ "$cleanup_called" = true ]]; then
+  printf 'lane cleanup ran after a failed Job\n' >&2
+  exit 1
+fi
+
+source "$ROOT/tests/kind/lib.sh"
+select_fixture_families all
+cleanup_calls=()
+cleanup_lane_durable_store() {
+  cleanup_calls+=(durable)
+  return 1
+}
+cleanup_lane_coordination_store() {
+  cleanup_calls+=(coordination)
+}
+cleanup_keycloak_lane() {
+  cleanup_calls+=(oidc)
+}
+cleanup_lane_target_store() {
+  cleanup_calls+=(target)
+}
+cleanup_lane_secret_store() {
+  cleanup_calls+=(secret)
+}
+if cleanup_lane_state 001 redis keycloak garage >/dev/null 2>&1; then
+  printf 'partial lane cleanup failure was ignored\n' >&2
+  exit 1
+fi
+if [[ "${cleanup_calls[*]}" != "durable coordination oidc target secret" ]]; then
+  printf 'lane cleanup stopped early: %s\n' "${cleanup_calls[*]}" >&2
+  exit 1
+fi
+
+printf 'fixture family matrix tests passed\n'