feat: fail smoke workflows when safe outputs are not invoked (#570)

* feat: fail smoke workflows when safe outputs are not invoked

Add post-step validation to smoke-claude, smoke-copilot, and
smoke-chroot workflows that checks outputs.jsonl exists and is
non-empty after the agent runs. On PR triggers, also requires
add_comment to be present, proving MCP servers work and a PR
comment was made. This prevents green pipelines when the agent
succeeds but never exercises safe output tools.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: post-process smoke lock files and document workflow compilation

Run postprocess-smoke-workflows.ts to replace GHCR image refs with
local builds. Add "Workflow Compilation" section to CLAUDE.md
documenting the required post-processing step after gh-aw compile.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add safe output validation to smoke-codex workflow

Apply the same post-step validation to smoke-codex that was added
to the other 3 smoke workflows. Compiled and post-processed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: recompile and post-process smoke-codex after merge

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: recompile and post-process all workflows after merging main

Merge origin/main (12 commits), recompile all smoke and build-test
workflows with gh-aw, and run postprocess to restore --build-local
and local install steps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka