ci(plugins): add Toolkit jar smoke tests to platform builds

After `./gradlew clean build` finishes, run the freshly built
Toolkit.jar through a few picocli subcommands so that runtime
class-loading errors in the fat jar are caught by CI rather than
slipping into a release.

Without this step, dependency-conflict bugs that survive `:plugins:test`
can still ship in the fat jar, because:
- the test classpath keeps source jars separate (classloader returns
  the first match), but
- the fat jar merges class entries with last-write-wins, so a
  different copy of a duplicated class can end up in the artifact.

The recent NoSuchMethodError on Options.maxBatchSize is exactly this
shape of bug: tests passed, fat jar broke. The smoke test catches it.

Smoke commands run on every platform build (macos / ubuntu-arm /
rockylinux-x86 / debian11-x86):
- `java -jar Toolkit.jar help` — exercises the top-level command tree
- `java -jar Toolkit.jar db --help` — loads all db subcommands
- `java -jar Toolkit.jar db archive -h` — directly exercises the
  leveldb Options path that previously broke
- `java -jar Toolkit.jar keystore --help` — exercises the :crypto
  module path added by the recent keystore migration

Each step adds ~10-15s; jobs run in parallel so PR critical path
increases by at most ~15s.

Author: Barbatos

.github/workflows/pr-build.yml

@@ -54,6 +54,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
   build-ubuntu:
     name: Build ubuntu24 (JDK 17 / aarch64)
     if: ${{ github.event_name == 'pull_request' || inputs.job == 'all' || inputs.job == 'ubuntu' }}
@@ -84,6 +93,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
   docker-build-rockylinux:
     name: Build rockylinux (JDK 8 / x86_64)
     if: ${{ github.event_name == 'pull_request' || inputs.job == 'all' || inputs.job == 'rockylinux' }}
@@ -127,6 +145,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
       - name: Test with RocksDB engine
         run: ./gradlew :framework:testWithRocksDb --no-daemon
 
@@ -172,6 +199,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon --no-build-cache
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
       - name: Test with RocksDB engine
         run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache