chore(ci): require verified TLS client compatibility

[yordis]

• Client compatibility must cover certificate-verified connections as well as plaintext before the transport migration can be considered safe.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cursor]

PR Summary

Low Risk
Changes are limited to CI compatibility scripts and workflow matrixing; no production server or client runtime code paths are modified.

Overview
Extends the cross-client compatibility gate so CI exercises plaintext and certificate-verified TLS before transport changes are considered safe.

The client-compatibility mise task now honors TROGON_EVENTSTORE_COMPATIBILITY_TLS: in TLS mode it generates short-lived test CAs and node certs (with a self-check script), mounts them via docker-compose-tls.yml, points clients at esdb:// with tlsVerifyCert and the trusted CA, and probes readiness over HTTPS. It also fails the run if the C# or Rust client connects when given an untrusted CA. Cleanup covers compose teardown and cert temp dirs.

The Ubuntu LTS workflow runs two matrix jobs (plaintext / tls), passes the TLS flag into the gate, and uploads separate client-compatibility-* artifacts.

^{Reviewed by Cursor Bugbot for commit a8d7ed8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ae58df51-8670-437e-8196-106a39129556

📥 Commits

Reviewing files that changed from the base of the PR and between 56eb784 and d8c24bc.

📒 Files selected for processing (5)

• .config/mise/tasks/github/actions/client-compatibility
• .github/compatibility/docker-compose-tls.yml
• .github/compatibility/generate-tls-certificates.sh
• .github/compatibility/tls.cnf
• .github/workflows/build-container-ubuntu-lts.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d8c24bc. Configure here.}