Fetch the protocol vectors in CI, which never had them

Turning off the build cache exposed twenty failures that had been there
all along: AccountKdfTest, PQVectorTest and PublishedVectorsTest look for
a sibling `flamenet-e2e` checkout. That exists on a developer's machine
and has never existed in a build directory, so every one of them has been
failing in CI since it was written — and CI reported green, because the
cache was replaying passes computed here.

These are the cross-implementation conformance tests. They are what says
this engine derives the same keys as the one iPhone runs; twenty of them
silently not running is the worst possible thing to find in the suite
that guarantees the two platforms can talk.

They fail rather than skip when the file is missing — deliberately,
exactly so this could not hide. It still hid, one layer up, in a cache.

`flamenet-e2e` is public, so the job shallow-clones it and points the
three environment variables at the result. The paths are checked before
the suite runs: a variable pointing at nothing would put the tests back
where they were, and the failure would read as a protocol bug rather than
a missing file.

Cloned at its tip rather than pinned. The vectors are normative and
shared with iOS, so if the published protocol changes this suite SHOULD
go red without a commit here — that is a real divergence, not a stale
pin.

Verified the variables are actually honoured, rather than assuming: with
one pointed at an empty JSON file the test reddens even though the
sibling checkout is present. 539 engine tests pass against the cloned
vectors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -22,6 +22,31 @@ unit-tests:
   script:
     - export JAVA_HOME=/opt/homebrew/opt/openjdk@21
     - export ANDROID_HOME=$HOME/Library/Android/sdk
+    # 🔴 **The protocol vectors are not in this repo, and CI never had them.**
+    # `AccountKdfTest`, `PQVectorTest` and `PublishedVectorsTest` look for a
+    # sibling `flamenet-e2e` checkout. That exists on a developer's machine and
+    # has never existed in a build directory, so all twenty of them have been
+    # failing here since they were written — invisibly, because the build cache
+    # replayed a local pass. They fail rather than skip when the file is
+    # missing, exactly so this could not hide; it took `--rerun-tasks` to let
+    # them say so.
+    #
+    # ⚠️ Cloned at its tip rather than pinned. These vectors are normative and
+    # shared with iOS: if the published protocol changes, this suite SHOULD go
+    # red without a commit here, because that is a real divergence and not a
+    # stale pin. `flamenet-e2e` is public, so no credentials are needed.
+    - rm -rf "$CI_PROJECT_DIR/.ci-vectors"
+    - git clone --depth 1 https://gitlab.com/paulhitt/flamenet-e2e.git "$CI_PROJECT_DIR/.ci-vectors"
+    - export FLAMENET_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/protocol-v1.json"
+    - export FLAMENET_PQ_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/pqx3dh-v2.json"
+    - export FLAMENET_ACCOUNT_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/account-kdf-v1.json"
+    # ⚠️ Checked before the suite runs. A path that silently does not exist puts
+    # the tests straight back where they were, and the failure would read as a
+    # protocol bug rather than a missing file.
+    - |
+      for f in "$FLAMENET_VECTORS" "$FLAMENET_PQ_VECTORS" "$FLAMENET_ACCOUNT_VECTORS"; do
+        [ -f "$f" ] || { echo "GATE: vector file missing: $f"; exit 1; }
+      done
     # 🔴 **Clear old results before running, or the gate counts ghosts.** The
     # runner reuses its build directory, so XML from a previous pipeline
     # survives — and a suite that stopped running entirely would still be