ci: tighten Linux smoke endpoint posture (TIN-1540)

[Jesssullivan]

Summary

• factor TCFS smoke endpoint posture checks into a reusable Python preflight helper
• make GitHub-hosted Linux package smoke require public HTTPS storage endpoints
• keep self-hosted/private Linux runner labels eligible for private or plaintext smoke backends
• add a local regression test for hosted/public vs private-runner endpoint classification

Why

The latest Linux postinstall smoke failed before package install because the hosted Ubuntu runner could not resolve the private SeaweedFS endpoint. This makes that contract explicit: hosted runners need public HTTPS storage; private endpoints require a self-hosted runner.

Validation

• python3 scripts/test-tcfs-smoke-endpoint-preflight.py
• python3 -m py_compile scripts/tcfs-smoke-endpoint-preflight.py scripts/test-tcfs-smoke-endpoint-preflight.py
• ruby -ryaml -e 'YAML.load_file(ARGV.fetch(0))' .github/workflows/linux-postinstall-smoke.yml
• ruby -ryaml -e 'YAML.load_file(ARGV.fetch(0))' Taskfile.yaml
• git diff --check origin/main...HEAD

Refs: TIN-1540, TIN-1422, TIN-1546

[Jesssullivan]

Ready-to-diagnose note:

This PR intentionally does not claim Linux package smoke is green. It tightens the preflight so the next run clearly separates:

• hosted Ubuntu + public HTTPS endpoint: allowed
• hosted Ubuntu + tailnet/bare/private/plaintext endpoint: fail fast
• self-hosted/private Linux runner + private/plaintext endpoint: allowed

Focused validation already run locally:

• python3 scripts/test-tcfs-smoke-endpoint-preflight.py
• python3 -m py_compile scripts/tcfs-smoke-endpoint-preflight.py scripts/test-tcfs-smoke-endpoint-preflight.py
• workflow YAML parse
• Taskfile YAML parse
• git diff --check origin/main...HEAD