feat(cli): add openshell conformance subcommand skeleton

Adds a hidden `openshell conformance` subcommand behind a `conformance`
Cargo feature flag. The subcommand connects to a registered gateway and
runs a suite of driver-agnostic conformance scenarios, reporting pass/fail
per scenario and exiting non-zero on any failure.

Implements the `lifecycle` scenario (create → ready → delete) as the first
concrete scenario. The remaining five scenarios are stubbed as "not yet
implemented" placeholders.

Sandbox names follow the `conformance-<scenario>-<run-id>` convention
(Kubernetes RFC 1123 safe) to make orphaned sandboxes identifiable.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-cli/Cargo.toml

@@ -86,6 +86,7 @@ workspace = true
 
 [features]
 bundled-z3 = ["openshell-prover/bundled-z3"]
+conformance = []
 
 [dev-dependencies]
 futures = { workspace = true }

crates/openshell-cli/src/main.rs

@@ -554,6 +554,27 @@ enum Commands {
         command: Option<DoctorCommands>,
     },
 
+    /// Validate that a gateway and its driver are functioning correctly.
+    ///
+    /// Runs a suite of conformance scenarios against the configured gateway
+    /// and reports pass/fail for each. Exits non-zero if any scenario fails.
+    ///
+    /// All sandboxes created by this command use the naming convention
+    /// `conformance-<scenario>-<run-id>` and are cleaned up on completion.
+    /// If the command is interrupted, any remaining sandboxes can be
+    /// identified by the `conformance-` prefix.
+    ///
+    /// Examples:
+    ///   openshell conformance run
+    ///   openshell conformance run --filter lifecycle
+    ///   openshell conformance run --timeout 120
+    #[cfg(feature = "conformance")]
+    #[command(hide = true, help_template = SUBCOMMAND_HELP_TEMPLATE)]
+    Conformance {
+        #[command(subcommand)]
+        command: ConformanceCommands,
+    },
+
     // ===================================================================
     // ADDITIONAL COMMANDS
     // ===================================================================
@@ -1186,6 +1207,47 @@ enum InferenceCommands {
     },
 }
 
+// -----------------------------------------------------------------------
+// Conformance commands
+// -----------------------------------------------------------------------
+
+#[cfg(feature = "conformance")]
+#[derive(Subcommand, Debug)]
+enum ConformanceCommands {
+    /// Run the conformance suite against the configured gateway.
+    ///
+    /// Connects to the gateway using the registered credentials and runs
+    /// each conformance scenario in sequence. Reports pass/fail per
+    /// scenario and exits non-zero if any scenario fails.
+    ///
+    /// Examples:
+    ///   openshell conformance run
+    ///   openshell conformance run --filter lifecycle
+    ///   openshell conformance run --timeout 120
+    #[command(help_template = LEAF_HELP_TEMPLATE, next_help_heading = "FLAGS")]
+    Run {
+        /// Only run scenarios whose name contains this substring.
+        #[arg(long, short = 'f')]
+        filter: Option<String>,
+
+        /// Seconds to wait for each scenario to complete.
+        #[arg(long, default_value = "300")]
+        timeout: u64,
+
+        /// Output format.
+        #[arg(short = 'o', long = "output", value_enum, default_value_t = OutputFormat::Table)]
+        output: OutputFormat,
+    },
+
+    /// List available conformance scenarios without running them.
+    #[command(help_template = LEAF_HELP_TEMPLATE, next_help_heading = "FLAGS")]
+    List {
+        /// Output format.
+        #[arg(short = 'o', long = "output", value_enum, default_value_t = OutputFormat::Table)]
+        output: OutputFormat,
+    },
+}
+
 // -----------------------------------------------------------------------
 // Doctor (diagnostic) commands
 // -----------------------------------------------------------------------
@@ -2062,6 +2124,35 @@ async fn main() -> Result<()> {
             }
         },
 
+        // -----------------------------------------------------------
+        // Conformance commands
+        // -----------------------------------------------------------
+        #[cfg(feature = "conformance")]
+        Some(Commands::Conformance { command }) => {
+            let ctx = resolve_gateway(&cli.gateway, &cli.gateway_endpoint)?;
+            let mut tls = tls.with_gateway_name(&ctx.name);
+            apply_auth(&mut tls, &ctx.name);
+            match command {
+                ConformanceCommands::Run {
+                    filter,
+                    timeout,
+                    output,
+                } => {
+                    run::conformance_run(
+                        &ctx.endpoint,
+                        &tls,
+                        filter.as_deref(),
+                        timeout,
+                        output.as_str(),
+                    )
+                    .await?;
+                }
+                ConformanceCommands::List { output } => {
+                    run::conformance_list(output.as_str())?;
+                }
+            }
+        }
+
         // -----------------------------------------------------------
         // Doctor (diagnostic) commands
         // -----------------------------------------------------------