Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

tests/README.md

@@ -80,3 +80,30 @@ The host tests do not establish CI trust policy, real asynchronous kernel I/O,
 real policy ownership under Driver Verifier, revocation/timestamp behavior, or
 all Windows-version/layout combinations. See the
 [implementation ledger](../docs/implementation-status.md) for the remaining work.
+
+## Consumer helper regression tests
+
+Run `python tests/run-consumer-helper-tests.py` in an x64 Visual Studio developer
+shell. This fifth host runner compiles the actual certificate/common-consumer
+implementations and the existing PID name function, with kernel operations
+replaced by deterministic doubles. Hashing uses real Windows CNG; independent
+Crypt32 decoding/re-encoding/hash calls verify SPKI representation and pins.
+The synthetic v1/v3 certificates are framing fixtures, not trust fixtures.
+
+Coverage includes truncated certificate prefixes at inaccessible guard pages,
+malformed DER lengths and optional read-only comparisons with real system-root
+certificate SPKIs,
+four hash algorithms, short capacities and four injected CNG failures, strict
+hex conversion across all byte values, path/handle ownership, failed references,
+partial publisher allocation, process-name query failures, stale-output cleanup,
+and malformed/overflowing x64 chain spans. A second host build exercises the
+non-x64 rejection branch without claiming ARM64 ABI or runtime emulation.
+No service is started, certificate trusted, or real CI policy evaluated.
+
+## Deprecation compiler checks
+
+Run `python tests/run-deprecation-tests.py --arch x64` or `--arch ARM64` from a
+Visual Studio developer shell with the WDK installed. This compile-only runner
+uses the actual public headers: modern API references must compile under /WX,
+while each of four deprecated references must fail specifically with C4996 and
+its migration message. Both C and C++ are checked. It does not link or load code.