CI: run the proto-companion generate tests (proto_companion_required, linux-amd64-docker-generate) #1171

What is missing

No workflow under .github/workflows/ runs the proto-companion tests of cmd/generate and cmd/publish:

• tests tagged //go:build proto_companion_required (proto_companion_test.go, client_proto_sources_companion_test.go, cmd/publish/clients_proto_sources_companion_test.go);
• tests gated on the linux-amd64-docker-generate conformance row (requireQualify, CODEFLY_GENERATE_QUALIFY=1), which docs/supported-matrix.md lists as "developer machine only".

Why it matters

These are the only proof of the contract between the CLI and the pinned proto companion: the buf ls-files --format json field names (path, import_path, is_import) that name a client's source set (#1166), generate proto input selection, and the generated client libraries. A companion upgrade that changes any of them surfaces only at runtime (for example "buf ls-files listed an unusable file"). Review r70 of #1166 found this, and #1166's own fixes were proven only locally.

Shape

Add a CI step (in the control-integration gate of go.yml, or its own job) that pulls the pinned companion image and runs go test -tags proto_companion_required over ./cmd/generate ./cmd/publish, and claim linux-amd64-docker-generate in that gate's conformance_rows so its tests can no longer skip. The second also means moving the row from not-yet-qualified in docs/supported-matrix.md. Folding the build tag into the conformance row would leave one gating mechanism instead of two.

The time budget, and the image pull from ghcr on shared runners, still have to be measured.