ask every binding the same question and insist on the same answer

There is one engine and nine doors into it, and nothing until now checked
that the doors agree. CI tested each binding against itself: the Python
wheel imported, the C demo compiled, the npm package type-checked. None
of that would have caught a field that crosses one boundary wrong, which
is the failure this library is most exposed to, because a wrong answer
about a fast day looks exactly like a right one.

So: twelve days, chosen where the bindings could plausibly differ, and
all twenty-two fields compared against what the command line says. The
days are Pascha itself, the Nativity on both calendars, a Wednesday of
the Great Fast under Byzantine Catholic law and again at the Typikon, a
weekday of the Nativity Fast where Greek and Slavic usage part, the one
Orthodox church on the Gregorian Paschalion, and a day with no feast.

A release now runs what a push runs. It had been gated on cargo test
alone, so the C ABI, the Lua binding, the Python parity check and the
README examples were checked on the branch that led to a release and not
on the release. Neither registry will reuse a version, so the gate
belongs before the upload.

Writing it found three things. The npm exports map did not expose the
wasm by package path, so a bundler asked for typikon/web/typikon_bg.wasm
was told no such path exists and had to reach into node_modules; the
documented init() call was never affected. The suite could hang instead
of fail, because the test web server was backgrounded inside a subshell
and killed by job spec, leaving bash in do_wait forever. And pointing
XDG_CONFIG_HOME at a path that does not exist isolates typikon and
breaks every other program that keeps state under it, a browser included.

A surface whose toolchain is missing is named as skipped, and fewer than
three surfaces running is a failure rather than a pass, so a container
with nothing installed cannot come out green.

.forgejo/workflows/release.yml

@@ -32,8 +32,20 @@ jobs:
           echo "tag=$tag crate=$crate"
           [ "$tag" = "$crate" ] || { echo "::error::tag $tag != Cargo.toml $crate"; exit 1; }
 
+      # What CI runs on every push, run again here. A release is the one build
+      # nobody gets to re-run after the fact: PyPI will not reuse a version and
+      # neither will npm, so the gate belongs before the upload rather than
+      # only on the branch that led to it.
       - name: Tests
-        run: cargo test
+        run: |
+          rustup component add clippy
+          cargo clippy --all-targets -- -D warnings
+          cargo clippy --features python --all-targets -- -D warnings
+          cargo clippy --features capi --all-targets -- -D warnings
+          rustup target add wasm32-unknown-unknown
+          cargo clippy --lib --features wasm --target wasm32-unknown-unknown -- -D warnings
+          cargo test
+          cargo test --features capi
 
       - name: Build wheels and sdist
         run: |
@@ -76,6 +88,17 @@ jobs:
           npm/build.sh
           node npm/test.mjs
 
+      # The whole point of a release is that every door leads to the same
+      # engine. Checked here against what is about to be uploaded, and again
+      # after the fact with --published against what actually was.
+      - name: Every binding agrees
+        run: |
+          apt-get install -y --no-install-recommends chromium luajit
+          version=$(awk '/^name = "wasm-bindgen"$/{getline; gsub(/[",]/,""); print $3; exit}' Cargo.lock)
+          export PATH="/tmp/wasm-bindgen-$version-x86_64-unknown-linux-musl:$PATH"
+          tests/parity.sh
+          python3 tests/readme-examples.py
+
       - name: Publish
         env:
           # A project-scoped token, not the account-wide one. PyPI's trusted