Run IFC unit tests and doctests in CI

Signed-off-by: Jordan Mecom <jm@squareup.com>

Justfile

@@ -364,6 +364,10 @@ test-unit:
     set -euo pipefail
     ./scripts/test-ensure-local-relay-key.sh
     if command -v cargo-nextest &>/dev/null; then
+        # Check confidentiality and domain isolation in both IFC crates.
+        # nextest skips doctests, including the compile-fail API checks.
+        cargo nextest run -p ifc-core -p buzz-ifc
+        cargo test -p ifc-core -p buzz-ifc --doc
         cargo nextest run -p buzz-core -p buzz-auth --lib
         # buzz-auth NIP-FI verifier doctests. The sealed-authority
         # `compile_fail` doctests prove the default-feature public API alone

scripts/run-tests.sh

@@ -78,6 +78,10 @@ ensure_infra() {
 run_unit_tests() {
   section "Unit Tests (no infra required)"
 
+  # Include doctests: the compile-fail examples guard the IFC public API.
+  run_test_step "IFC unit tests and doctests" \
+    cargo test -p ifc-core -p buzz-ifc -- --nocapture
+
   run_test_step "buzz-core tests" \
     cargo test -p buzz-core --lib -- --nocapture