Run difftest weekly

The tool only protects the repo if it runs. It cannot join the ordinary
CI job, which must not depend on downloading and compiling SQLite, so it
gets a workflow of its own: weekly, on demand, with the artifacts cached
against the pin.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JzBeCg7rjweVW3uGPg5G7T

Author: claude

.github/workflows/difftest.yml

@@ -0,0 +1,39 @@
+# Differential testing against a real SQLite build.
+#
+# This is separate from CI because it downloads the pinned SQLite release
+# and compiles it, which the ordinary test run must not depend on. It is the
+# only thing that exercises error fidelity at scale: the vendored corpus is
+# almost all valid SQL, so mutating it is how divergent messages and offsets
+# get found.
+name: difftest
+
+on:
+  schedule:
+    - cron: "17 4 * * 1" # Mondays, early
+  workflow_dispatch:
+    inputs:
+      seed:
+        description: "PRNG seed"
+        default: "1"
+      per:
+        description: "mutations per corpus case"
+        default: "20"
+
+jobs:
+  difftest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Cache the pinned SQLite artifacts
+        uses: actions/cache@v4
+        with:
+          path: .sqlite
+          key: sqlite-${{ hashFiles('internal/sqlitesrc/sqlitesrc.go', 'internal/sqlitesrc/oracle/oracle.c') }}
+      - run: >
+          go run ./cmd/difftest
+          -per ${{ github.event.inputs.per || '20' }}
+          -depth 2
+          -seed ${{ github.event.inputs.seed || '1' }}

CLAUDE.md

@@ -77,9 +77,10 @@ go run ./cmd/difftest -files select1,expr    # a few files
 go run ./cmd/difftest -per 60 -seed 7        # dig harder, reproducibly
 ```
 
-It needs the oracle, so it is a development tool rather than a CI test. What
-it finds belongs in `parser/errors_test.go`, whose expectations are taken
-from the oracle rather than written by hand.
+It needs the oracle, so it is not part of `go test ./...`; a separate
+workflow (`.github/workflows/difftest.yml`) runs it weekly and on demand.
+What it finds belongs in `parser/errors_test.go`, whose expectations are
+taken from the oracle rather than written by hand.
 
 Two situations it deliberately skips, because the harness cannot compare
 them rather than because meyer might be wrong: a `;` inside parentheses,