Update native smoke for semantic releases

[luca-ctx]

Summary

• update packaged-candidate smoke to prove semantic search is supported, disabled by default, and fails closed offline without a cached model
• run the contract on native macOS and Windows release paths in addition to Linux
• carry the Windows build version in a generated CI evidence sidecar and refresh semantic release documentation

Validation

• bazel test //:native_candidate_smoke_tests //:linux_release_construction_tests //:release_binary_compat_tests //:buildkite_pipeline_check //:docs_check //:loc_check --config=ci --test_output=errors
• real packaged ctx 0.25.0 through both shell and PowerShell smoke helpers
• independent adversarial review: no remaining release-blocking findings

Residual coverage

• FreeBSD remains manually/VM runtime-tested because there is no standing native CI worker
• Linux release smoke is network-isolated; other native smoke paths enforce the product offline contract and assert no semantic/daemon state is created