ci: smoke-test published Linux release artifacts

[leodido]

Existing CI builds kfeatures from source, leaving the published Linux archives and their injected release version unchecked. Add smoke tests that download the actual release assets and execute their shipped binaries.

• After GoReleaser succeeds, release.yaml explicitly calls the reusable smoke workflow with github.ref_name. This waits for publication and avoids the GITHUB_TOKEN limitation on triggering a separate release: published workflow; no moving latest or fixed sleep is used.
• A native matrix uses ubuntu-24.04 (amd64) and ubuntu-24.04-arm (arm64), with contents: read, SHA-pinned checkout, and no persisted checkout credentials. These labels are supported for public repositories.
• Each job validates the tag, checks the exact non-draft release, downloads its expected archive, extracts into a fresh temporary directory, requires an executable root-level binary without repairing permissions, and runs version with a 30-second timeout. The first line's tool-version token must equal the tag with its leading v removed; optional commit/date suffixes and the separate kernel version line are accommodated. Failures identify release, architecture, and step.
• Manual dispatch accepts a specific existing release tag. PRs touching these checks exercise fixed release v0.7.0 on the same native matrix. No privileged probes, packaging/signature changes, or CLI behavior changes.

Validation before opening:

• actionlint v1.7.7, ShellCheck, bash -n, and git diff --check pass.
• All 11 local archive fixtures pass, including prerelease/build normalization and malformed input, runner mismatch, unavailable archive, corrupt archive, missing binary, missing execute permission, startup failure, wrong/dev version, and draft/mismatched release cases.
• Full bats test/ passed on macOS (Linux-only cases skipped); the subsequently added eleventh fixture also passes.

Validation on the PR:

• Native published-artifact run passed on both amd64 and arm64, without emulation. Both downloaded the actual v0.7.0 archives and printed kfeatures 0.7.0 (86fcb3f) built 2026-05-25T01:34:53Z.
• Existing CI passed: Linux unit/race tests, coverage gate, Bats (including all 11 new fixtures), Linux integration, macOS CLI, and lint. CodeQL/security analysis also passed.

Remaining limits: Manual dispatch is unavailable until the new workflow reaches the default branch. The post-publication dependency cannot be exercised without a release; no release or tag is created by this PR. A failed smoke job reports failure after publication and does not roll back the release.