ci: add published install smoke matrix

[cafitac]

Summary

• Adds scripts/smoke_published_install.py to verify exact published package versions outside the source checkout.
• Covers npm registry lookup, npx, npm exec, uvx, and pipx bootstrap/doctor paths with isolated temporary homes.
• Adds a manual published-install-smoke workflow and wires the publish workflow to run the smoke matrix after npm/PyPI publish before creating the GitHub Release.
• Documents the automated/manual smoke flow and refreshes the handoff with the active slice status.

Verification

• uv run pytest tests/test_published_install_smoke.py tests/test_repository_trust_docs.py tests/test_npm_launcher.py::test_install_smoke_docs_cover_external_user_trust_matrix -q -> 13 passed
• uv run python scripts/smoke_published_install.py --version 0.1.18 --attempts 1 --delay-seconds 0 --timeout 180 --skip-pipx -> npm registry/npx/npm exec/uvx passed
• temp pipx wrapper + uv run python scripts/smoke_published_install.py --version 0.1.18 --attempts 1 --delay-seconds 0 --timeout 240 -> npm registry/npx/npm exec/uvx/pipx passed
• uv run pytest tests/ -q -> 144 passed
• uv run python scripts/check_release_metadata.py -> OK
• uv run python scripts/smoke_release_readiness.py -> OK
• npm pack --dry-run -> OK
• git diff --check -> OK

Notes

• actionlint is not installed locally, so workflow syntax will be validated by GitHub Actions CI.
• pipx commands explicitly pass the current Python interpreter to avoid resolving Python >=3.11 packages through an older default interpreter.