test: smoke test the container image before it is published

[gordonmurray]

Fixes #67

The test job installs the backend on the runner and runs pytest against the source tree. Nothing ran the image itself, so a fault in the Dockerfile reached the registry with every check green.

The build job now builds the amd64 image, starts it, and checks four endpoints before the publish step runs.

The fault this catches

COPY web/ /web/ in place of COPY web/vanilla/ /web/ builds without error and leaves the static files one directory too deep. The directory /web exists, so the chown succeeds and app.py mounts it. The image then answers every API request and serves no page:

/healthz    200  {"ok":true,"app_version":"0.3.1",...}
/datasets   200  {"datasets":[]}
/           404

The smoke test fails on that image and the publish step never runs.

Deleting the COPY line instead is already caught today, because the chown -R appuser:appuser /app /web that follows it fails on the missing directory. The wrong path is the case that gets through.

Notes

load: true accepts one platform, so the smoke image is amd64 only. The existing step still builds and pushes linux/amd64,linux/arm64, and it reuses the smoke layers from the cache.

Docker picks the host port and the step reads it back with docker port, so the step needs no free port on the runner.

An empty directory is enough for the mount, because entrypoint.sh only needs /data to exist and to be readable.

Test plan

• Workflow parses, and the smoke steps sit before the publish step
• Pass path: the released 0.33.0 image at v0.3.1 returns 200 on all four endpoints, exit 0
• Fail path: an image built with COPY web/ /web/ returns 404 on /, exit 22
• On failure the step prints the container logs and removes the container, with none left behind
• Both paths run with the step script taken verbatim from the workflow

The workflow runs on main, tags, and pull requests, so the change first runs in CI on this PR.