feat(T-5.8): cli smoke-test runner script

[GEOFARL]

Summary

• Adds apps/cli/scripts/smoke.sh — a parameterized end-to-end smoke runner that walks configure → whoami → generate --commit against any $API_URL, in a throwaway repo, asserting exit codes at every step and cleaning up temp config + workdir on exit.
• Routes both reads and writes through PROJECTRC_PATH: saveConfig's default now falls back to process.env.PROJECTRC_PATH before ~/.projectrc, so the script's exported temp path is honoured by configure. Without this fix, step 1 would have silently overwritten the operator's real ~/.projectrc on a successful run.
• Hardens setup: cd is guarded; throwaway-repo init runs in a set -e subshell so any failure surfaces at the real call site.

Scope note (staging vs. production)

docs/11-deployment.md §1 states this project is single-environment CD — there is no staging stack. The task title "Staging smoke test" is therefore reinterpreted as: ship a parameterized checklist runner now, and have the operator record a production run after the first deploy.

This script is operator-driven (step 4 invokes the inquirer suggestion picker). Do not wire it into unattended CI.

Doc updates (gitignored — not in this diff)

docs/ is gitignored in this repo, so the following edits live only in the working copy:

• docs/tasks/phase-5-cli/T-5.8-staging-smoke.md — deliverable description, the negative-path wiring proof, and a structured template for the operator's production run record.
• docs/11-deployment.md §11 — build-checklist entry now references apps/cli/scripts/smoke.sh.

Test plan

• pnpm -F @commit-analyzer/cli typecheck
• pnpm -F @commit-analyzer/cli lint
• pnpm -F @commit-analyzer/cli test (79 tests pass — adds one for saveConfig honouring PROJECTRC_PATH)
• bash -n apps/cli/scripts/smoke.sh (syntax)
• Negative wiring run: API_URL=http://127.0.0.1:1 API_KEY=git_… bash apps/cli/scripts/smoke.sh → script exits 4 (configure NetworkError), cleanup runs.
• Operator: positive run against production after first deploy, paste output into the task doc record.

Closes #65