Add CI validation helpers with explicit signature selection and owned results

tests/README.md

@@ -6,6 +6,7 @@ From an **x64 Visual Studio developer shell**, with the Windows SDK and Python 3
 python tests\run-digest-tests.py
 python tests\run-common-tests.py
 python tests\run-ci-probe-tests.py
+python tests\run-ci-validation-tests.py
 ```
 
 Build outputs are temporary. No driver is installed or loaded. Test runners
@@ -40,6 +41,25 @@ cover nonidentity name-ordinal mappings, forwarders, empty slots, invalid spans,
 unbounded strings, and deterministic failure outputs. The export API requires a
 valid loader-mapped module; it is not an arbitrary file parser.
 
+## CI validation result and selection helpers
+
+`run-ci-validation-tests.py` compiles the production wrapper source unchanged
+(apart from replacing its private include with test dependencies) and extracts
+the public declarations/constants. It checks native flag/level forwarding,
+64-byte capacity on every call, the opt-in x64 experimental bit, non-x64 mode
+rejection, invalid inputs, returned hash invariants, deterministic failure
+scalars, preserved diagnostic policies, and result cleanup/reuse. The embedded
+path covers all four explicit algorithms, unsupported/unsigned/invalid layouts,
+partial digest allocation cleanup, CI failure propagation and no catalog retry.
+CI/hash-layout behavior is injected; real digest behavior is checked by the
+existing Windows SIP/Crypt32 differential harness. A second host build exercises
+the non-x64 conditional branch; real ARM64 compilation is a separate build check.
+
+The first kernel trace used direct CI calls. Probe v2 in CodeIntegrity-RE now
+consumes these library helpers; a returned v2 trace is needed to claim runtime
+verification of the wrappers themselves. The earlier native result is not
+silently relabelled as an API-wrapper test.
+
 ## File-object validation flag probe
 
 See [the flag documentation and VM procedure](../docs/ci-validate-file-object.md)