feat(smoke): replace per-case pipelines with lane-based smoke suite

.gitattributes

@@ -17,9 +17,4 @@ tests/fixtures/runtime_imports_author_marker_stage.lock.yml linguist-generated=t
 tests/fixtures/runtime_imports_job.lock.yml linguist-generated=true merge=ours text eol=lf
 tests/fixtures/runtime_imports_stage.lock.yml linguist-generated=true merge=ours text eol=lf
 tests/fixtures/stage-agent.lock.yml linguist-generated=true merge=ours text eol=lf
-tests/safe-outputs/azure-cli.lock.yml linguist-generated=true merge=ours text eol=lf
-tests/safe-outputs/canary.lock.yml linguist-generated=true merge=ours text eol=lf
-tests/safe-outputs/janitor.lock.yml linguist-generated=true merge=ours text eol=lf
-tests/safe-outputs/noop-target.lock.yml linguist-generated=true merge=ours text eol=lf
-tests/safe-outputs/smoke-failure-reporter.lock.yml linguist-generated=true merge=ours text eol=lf
 # END ado-aw managed

.github/workflows/release.yml

@@ -221,32 +221,3 @@ jobs:
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release upload "$TAG" checksums.txt --clobber --repo "${{ github.repository }}"
 
-  trigger-recompile-safe-output-fixtures:
-    name: Trigger safe-output fixture recompile
-    needs: [release-please, checksums]
-    # Run only once all release assets (binaries + checksums.txt) are uploaded.
-    # Releases published via release-please do NOT fire the `release: published`
-    # event on other workflows (GitHub suppresses this to prevent recursive
-    # triggers), so we explicitly dispatch the recompile workflow here. The
-    # default GITHUB_TOKEN has the `actions:write` scope needed to run
-    # `gh workflow run`; the dispatched workflow uses its own secrets for any
-    # downstream PR creation.
-    if: >-
-      always() &&
-      (needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch') &&
-      needs.checksums.result == 'success'
-    runs-on: ubuntu-22.04
-    permissions:
-      actions: write
-    steps:
-      - name: Dispatch recompile-safe-output-fixtures
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
-          echo "Dispatching recompile-safe-output-fixtures for $TAG"
-          gh workflow run recompile-safe-output-fixtures.lock.yml \
-            --repo "${{ github.repository }}" \
-            --ref main \
-            -f "version=$TAG"

.github/workflows/review-compiler-contract.md

@@ -110,12 +110,17 @@ so frame it as "CI will fail" rather than as a silent risk.
 If any `.github/workflows/*.md` changed without its `.lock.yml`, the workflow
 will not run as written. Fix: `gh aw compile`.
 
-### Release-owned fixtures
+### Markdown-only smoke sources
 
-`tests/safe-outputs/*.lock.yml` are the **latest released** customer contract.
-Their runtime integrity step downloads the released compiler, so regenerating
-them from an unreleased checkout produces drift even when Cargo reports the same
-version. If this PR modifies them outside the release workflow, flag it.
+`tests/safe-outputs/` holds smoke **sources only** — no `*.lock.yml` files are
+committed there, and both smoke lanes recompile each markdown source at run
+time. If this PR adds a committed lock file under `tests/safe-outputs/`, that is
+a finding: it reintroduces the drift the lane model removed.
+
+Adding a smoke should be a markdown source plus one entry in
+`tests/smoke/cases.json`. A PR that instead registers a new ADO definition per
+test case, or adds a per-case `*_DEFINITION_ID` orchestrator variable, is
+working against the design — flag it.
 
 ## Step 3 — Schema and registry contracts
 

.github/workflows/review-tests.md

@@ -75,9 +75,12 @@ Two ado-aw-specific rules worth knowing:
 - **Any new `bash:` step in generated pipeline YAML must be covered by
   `tests/bash_lint_tests.rs`.** ADO's "fail on last command" default lets silent
   failures through, which is exactly what that test exists to catch.
-- **`tests/safe-outputs/*.lock.yml` are release-owned.** They are the latest
-  released customer contract and must not be regenerated from a development
-  checkout. If this PR regenerates them, that is a finding.
+- **`tests/safe-outputs/` is markdown-only.** Smoke sources are recompiled at
+  run time by both smoke lanes; no `*.lock.yml` is committed there. A PR that
+  adds one has reintroduced lock drift — that is a finding.
+- **New smokes should cost two files.** A markdown source plus one entry in
+  `tests/smoke/cases.json`. A PR that registers a per-case ADO definition or
+  adds a per-case `*_DEFINITION_ID` variable is working against the lane model.
 
 ## Step 1 — Load the pre-fetched data