test: gate releases on enforced conformance and installed package checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

.forgejo/workflows/ci-smoke.yaml

@@ -1,4 +1,4 @@
-# CI smoke — package tests prove hub-core library health on push.
+# Local source, enforcement, inventory and installed-package gates.
 name: CI Smoke
 
 on:
@@ -22,23 +22,21 @@ jobs:
   pytest-smoke:
     runs-on: self-hosted
     steps:
-      - name: Run hub-core pytest
+      - name: Test enforcement, inventory and installed package
         run: |
           set -eu
-          REF="${GITHUB_SHA:-main}"
-          SHORT="${REF:0:7}"
-          ROOT="${HOME}/ci-hub-core-${SHORT}"
-          rm -rf "${ROOT}"
-          mkdir -p "${ROOT}"
-          wget -qO /tmp/hub-core.tar.gz \
-            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
-          tar xzf /tmp/hub-core.tar.gz -C "${ROOT}" --strip-components=1
-          cd "${ROOT}"
+          REF="${GITHUB_SHA:?commit SHA required}"
+          CI_WORKDIR="$(mktemp -d)"
+          trap 'rm -rf -- "$CI_WORKDIR"' EXIT
+          wget -qO "$CI_WORKDIR/source.tar.gz" \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          mkdir "$CI_WORKDIR/source"
+          tar xzf "$CI_WORKDIR/source.tar.gz" -C "$CI_WORKDIR/source" --strip-components=1
+          cd "$CI_WORKDIR/source"
           if ! command -v uv >/dev/null 2>&1; then
             pip install --user uv
             export PATH="${HOME}/.local/bin:${PATH}"
           fi
-          uv sync
-          uv run python -c "import hub_core; print(hub_core.__version__)"
-          uv run python -m pytest -q
-          echo "hub-core pytest smoke ok @ ${SHORT}"
+          uv sync --locked --group dev --extra runtime
+          make ci-check
+          echo "hub-core source, enforcement, inventory and package checks passed @ ${REF}"