[aidangarske]

• CI tested one wolfSSL config (--enable-all), built from an unpinned master clone whose cache only refreshed when the workflow
  file changed, and default builds only ran go vet . and the handles tests.
• A reusable resolve job picks the latest v*-stable wolfSSL tag and master on every run, and a setup-wolfssl action builds each
  one keyed by its commit SHA and configure flags, so caches track upstream.
• A config matrix runs every package against all, default, opensslextra, writedup, oldtls, notls13, two reduced builds, certgen
  without certext, and the FIPS Ready 5.9.4 bundle (sha256 pinned), on both wolfSSL refs.
• Each config asserts its wolfSSL defines, tests or link-checks each package, requires packages that need a missing feature to
  fail with their documented error, and builds every example program and runs example tests.
• Full-featured configs run with -race, the rest with checkptr; ASan and UBSan jobs instrument wolfSSL and the cgo code, and
  MSan runs nightly as non-blocking.
• Static analysis runs gofmt on changed files, go vet with every analyzer, staticcheck, govulncheck (including each example
  binary), and CodeQL for Go.
• Go 1.21, oldstable and stable are tested with GOTOOLCHAIN=local, and gcc-12 to 14 and clang-16 to 18 build with -Wall
  -Werror.
• New fuzz targets cover the X509, RSA key, certificate and EC key parsers; seeds run in every go test, and the nightly fuzzes
  each target for 10 minutes.
• New interop tests run wolftls against crypto/tls in both directions (default, TLS 1.2 and TLS 1.3 with ALPN, SNI, bad
  hostname, untrusted CA), and the example client and server run against OpenSSL with certificates minted per run.
• Every new Linux job runs in ghcr.io/wolfssl/go-wolfssl-ci, pinned by digest, which bakes in the compilers and sanitizer
  runtimes, autotools, OpenSSL, Go 1.21/1.26/oldstable/stable, staticcheck, govulncheck, actionlint and shellcheck, so jobs
  install nothing.
• publish-ci-image.yml rebuilds and smoke-tests that image on master when its files change, and checks the package can be
  pulled anonymously for fork PRs.
• A nightly workflow dispatches the suite, opens or comments on a nightly-failure issue when anything fails, and closes it once
  a later nightly passes.
• On master these jobs fail until the open Fenrir PRs land, by design: vet unsafeptr and the -race checkptr crash
  (wolftls-conn), the reduced and certgen-noext configs (build-stubs, wolfx509), the d2i_X509 cgo pointer rule hit by the X509
  fuzz seeds (tls-x509-wrappers), and staticcheck SA4006 in the example clients and servers (examples).
• With those PRs merged, the remaining failures are real gaps: opensslextra fails to link (no OBJ_txt2obj stub), notls13 has no
  TLSv1_3 method stubs, FIPS Ready rejects private key export in the handles ECC tests, three wolftls-conn tests need feature
  skips on default, and staticcheck flags unused equalName/equalRaw and one ST1008.
• The fuzz targets use testing.F (Go 1.18+), and CI's floor is Go 1.21, while go.mod still says go 1.13; bumping go.mod is left
  for a separate change.
• The reduced2 config builds wolfSSL without its own unit tests and -Werror, because wolfSSL's tests and 5.9.4's random.c do
  not build with SHA-256 disabled.
• The existing build, lint and test-tls workflows still apt-get install autotools; they move into the image in a follow-up,
  since six open Fenrir PRs edit them.