Smoke-test release packages from one matrix job

[calvintvu]

Context

release.yml carried the same 28-line smoke block twice — once inline in build for arm64, once in smoke-intel for amd64 — differing only in the archive stem. Two copies on the path that publishes binaries is where drift costs the most.

Both also reimplemented, less thoroughly, what collector/scripts/smoke.sh already does for make smoke.

Changes

• Replace both blocks with one smoke matrix job over {arm64, macos-15} and {amd64, macos-15-intel}. It unpacks the archive, checks --version against the tag, and calls scripts/smoke.sh.
• publish now needs [build, smoke].

Coverage goes up, not down. The old blocks checked only that / served aroot div and that /api/sessions parsed as JSON. smoke.sh additionally asserts the page title, that a /assets/*.js referenced by the document resolves, that /coslash survives a direct hit, that a missing asset returns 404 rather than falling back to the SPA document, and that an unrouted /api path returns 404. It also drops the third JSON validator — the old blocks used python3 -m json.tool, smoke.sh uses jq with a grep fallback.

Two things reviewers should weigh:

• The smoke job needs actions/checkout to reach the script. That is one extra step per arch, and it means the smoke job now tests the script at the tag being released rather than a copy frozen into the workflow.
• The arm64 run moves out of build, so artifacts upload before either arch is verified. publish needs both jobs, so nothing untested reaches a release; the artifacts are internal, with 1-day retention.

fail-fast: false so one arch failing still reports the other.

Test

• ruby -ryaml parse — valid; jobs resolve to build → smoke → publish →bump-homebrew, matrix expands to the two expected pairs, no smoke-intel references left.
• make -C collector dist VERSION=v9.9.9-test — passed, two archives plus checksums.txt.
• Replayed the new job body verbatim on darwin-arm64 against the real packaged tarball: checksums verified, - version returned v9.9.9-test, and scripts/smoke.sh passed all seven assertions.
• Confirmed neither check is vacuous: the version guard exits 1 on a mismatch, and scripts/smoke.sh <bare-binary> embedded fails with no frontend assets are embedded in this binary. That is the one failure mode that could otherwise ship behind a green check.

Not covered: the amd64 leg on real Intel hardware, and the tap-publish job — both unchanged by this PR and both unavailable locally.