[jinxiao]

Issue

Closes #31

Summary

Add a required Runtime simulation job after packaged module verification. It rebuilds both Lambda architectures and executes the maintained Docker RIE, streaming, live Valkey/TypeScript bridge, saved Batch, and Go-to-TypeScript KMS suites using synthetic local endpoints.

Bind reports to the tested commit, workflow run, and attempt; reject missing/failed/stale evidence and cleanup errors, preserve checked-in acceptance history, and upload reports and failure diagnostics. Require runtime success for automatic and manual release publication as well as main merge protection.

Testing

• tools/test_runtime_ci.py: 10 offline evidence-safety regressions passed.
• tools/test_release.py: 37 release regressions passed, including real pinned GoReleaser CLI fixtures and runtime gating on PR/main commits.
• tools/test_release_automation.py: 22 automation regressions passed, including missing/pending/failed/skipped runtime checks preventing publication.
• actionlint v1.7.12, Node syntax validation, license/notice checks for all 31 modules, and whitespace checks passed.
• Native PR Go CI run 37234163654 passed all 31 packaged modules / 28 public consumers and 1,121 runtime assertions: 904 RIE/Valkey, 95 Streaming, 14 Batch, and 108 KMS reverse interoperability checks. Both architectures rebuilt, amd64 executed, cleanup passed, and checked-in history was preserved. Documentation and contribution checks passed. No AWS cloud test was run.

Risks and compatibility

PR/main CI takes longer because it now executes the maintained runtime suites. Docker runs amd64; arm64 is rebuilt but not executed. Node reference fixture regeneration remains a deliberate development operation. The observed Runtime simulation check is now required in the existing active main ruleset; its other protections are preserved. The first hosted acceptance is recorded in docs/CI_RUNTIME_ACCEPTANCE.json.

Release notes

• repository | maintenance | Require synthetic Lambda runtime and cross-language data simulation checks before merging or releasing.

Checklist

• The issue records the scope and acceptance criteria
• Tests and documentation match the change, or I explained why they are not applicable
• I kept CGO disabled and did not run cloud AWS tests without authorization
• I excluded credentials, personal configuration, and generated build artifacts