[EricAndrechek]

Makes the v1-network job run each binding's conformance runner (when its runner file exists on the branch) against the job's TLS registry:2, and upload report-<binding>-registry.json with toolchain registry, which is what v1-parity requires before a binding can enroll.

• Runner detection is the same four paths v1-conformance uses; a binding with no runner skips loudly and uploads nothing.
• The runners have no registry-only switch, so the job derives the report from the raw one: registry rows only, toolchain registry. A missing report, zero registry rows, or any failing registry row fails the job.
• registry:2 now holds every tree the registry cases name (scripts/fetch-v1/push_tree.py); before, it held only basic, so four of the five cases could not find their tags (measured on the proof run).
• TLS comes from the OS store (the throwaway CA via update-ca-certificates); no binding is told about the CA. Node is opted in with its documented --use-system-ca (NODE_OPTIONS), never by disabling verification.
• CHTYPES_V1_TOOLCHAIN is exported from the v1-conformance matrix leg (and registry here), documented in the runner contract of docs/guides/fetch-v1.md. The runner-side reads are the binding lanes' job.
• The job still does not run in the no-network sandbox (it needs the local registry); commented in the workflow. v1-network is not a required context; v1-parity is, and its name is unchanged.

Proof (throwaway branch with the Go runner merged, since closed and deleted): run 37138707136, Go registry report 5 results, 5 pass, 0 fail; v1-parity printed go: pass (1 toolchain leg(s) + registry: yes).

🤖 Generated with Claude Code