Catch3 keeps Catch2's API for writing tests (test cases, sections,
assertions, matchers, generators, listeners, benchmarks) and replaces its
session, command line and reporters with a runner of its own.

The runner starts the test binary again as worker processes that take the
next test when they are free. A crash, an exit or a hang ends one test, not
the run. On top of that it adds:

- retries that tell deterministic, flaky and order-dependent failures
  apart, and a bisection that names the test leaving state behind;
- a history of verdicts and durations, kept under a file lock, that drives
  automatic quarantine, adaptive time limits, predictive ordering,
  incremental runs, failure replay and analytics;
- selection by change, past failure or prediction, dependency closure,
  and sharding by a stable hash or by recorded durations;
- tags for serial and isolated tests, shared resources, dependencies,
  time limits and retries;
- a failure category, a signature, an analysis and a replay command for
  every failure;
- console, JUnit XML (with flakyFailure and rerunFailure), JSON and Chrome
  trace reports, and a versioned discovery listing (--list=json);
- a temporary directory per test (TMPDIR, TMP, TEMP and
  TestTemporaryDirectory());
- Bazel's test environment: XML output file, test filter, sharding, seed,
  premature exit file and undeclared outputs.

The command line is parsed by a hand-written, typed parser. Catch::Session
remains as a thin facade over the runner for custom main functions.

The result model in Progmasoft/Catch3/Results.hpp was rewritten around
tests and attempts, and the JUnit writer now writes it. The property
engine's example database is updated under a file lock with an atomic
rename, so parallel workers can write it at the same time.

Removed: Clara, the command-line and reporter-spec parsers, every reporter
and CATCH_REGISTER_REPORTER, listing, text flow, console colour and width,
the JSON and XML writers, sharding in the test registry, approval tests and
their baselines, Conan packaging, and the unused third_party/clara.hpp.
Listeners keep working; reporters' list and skip events are gone.

The Catch2 library is now compiled as C++20; code that includes only
Catch2's headers still needs C++14. Duplicate test cases are still refused
at start-up. Version 0.3.0.

ExtraTests now turn exceptions off for clang-cl with MSVC-style options,
which -fno-exceptions did not do.

The compiler that uses this framework first is built and tested on
Windows with the Visual Studio 2026 image, macOS 15 and 26, Ubuntu 26.04
and Fedora 43. This repository was tested on Windows Server 2022 and
2025, macOS 14, 15 and 15 on Intel, and on no Linux at all.

The Windows builds move to the windows-2025-vs2026 image, in the basic
builds and in the Xmake, Bazel and Meson builds. The macOS builds and
the sanitizer builds run on macos-15 and macos-26. A new workflow builds
and tests on Ubuntu 26.04 and, in a container, on Fedora 43, with Clang,
as C++14 and C++17, Debug and Release.

Two jobs stay on windows-2022: the Premake job generates Visual Studio
2022 projects, and the Conan job names the Visual Studio 17 generator
and the v144 runtime. Moving them means moving those tools to Visual
Studio 2026, which is a change of its own.

The owner decided against running OpenSSF Scorecard here. The workflow
added by the commit before this one is removed; nothing else changes.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.