The public API: build a driver, then check an implementation against a spec.

Decode Quint's ITF trace files into EDN. Pure: no file or process I/O.
What Quint emits, and why parts of it are odd, is in docs/notes/itf-format.md.

Run the Quint CLI and collect the ITF files it writes. The only namespace
that shells out.

Turn `:quint/*` metadata into the resolved driver replay consumes. The only
namespace that reflects, and only over the explicit `:scan` list. Rebuilt on
every call: no global registry, nothing cached between runs.

What it reads is decided here; whether what it read can be used is decided in
`registry.validation`, which reflects over nothing.

The loud half of the registry: every check that turns an annotation nobody
would read into an error at driver construction.

Nothing here reflects. `registry` does the reading — `ns-interns`, `meta`,
`deref` — and hands over what it found; these functions decide whether it can
be used and say why not. That split is why the reflection rule still reads
"confined to `registry`" with this namespace underneath it.

Run one decoded trace against a resolved driver. No I/O of its own: the only
effects are the ones the driver's own functions perform.

Result data -> string. A consumer of what replay returns, never a second
source of truth about it.

clojure.test integration: one assertion carrying the whole failure, and the
failing trace written where a regression test can replay it.