ci: add packaging release gates with artifact smoke checks

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main, "001-cli-plugins-base"]
+    branches: [main, "001-cli-plugins-base", "candidate/**"]
   pull_request:
-    branches: [main]
+    branches: [main, "candidate/**"]
 
 jobs:
   test:
@@ -47,3 +47,43 @@ jobs:
 
       - name: Ruff format check
         run: ruff format --check src/ tests/
+
+  package-release-gates:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: python -m pip install --upgrade pip build
+
+      - name: Build sdist and wheel
+        env:
+          SOURCE_DATE_EPOCH: "1704067200"
+        run: python -m build --sdist --wheel --outdir dist
+
+      - name: Validate build artifacts
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          sdists=(dist/*.tar.gz)
+          wheels=(dist/*.whl)
+          test "${#sdists[@]}" -eq 1
+          test "${#wheels[@]}" -eq 1
+          ls -lh dist
+
+      - name: Install built wheel and run smoke import checks
+        run: |
+          set -euo pipefail
+          python -m venv .venv-smoke
+          . .venv-smoke/bin/activate
+          python -m pip install --upgrade pip
+          python -m pip install --no-deps dist/*.whl
+          python -c "import crawler, generator, config, lib; print('artifact smoke import OK')"
+          cli-crawler --help >/dev/null
+          generate-plugin --help >/dev/null
+          config-audit --help >/dev/null