Phase 7 follow-up — validates the consumer install path after every stable release.

Summary

• New workflow .github/workflows/e2e-post-release.yml fires on release: published (stable only — prerelease != true)
• Runs VERSION=<tag> curl install.sh | bash (consumer install path), confirms binary at $HOME/.polkadot/bin/dot
• Reuses e2e/cli/published.test.ts smoke tests via DOT_E2E_BINARY env (set through $GITHUB_ENV so $HOME expands correctly)

Distinct from Phase 7

• Phase 7's e2e-release.yml fires on RC (prereleased) and uses gh release download directly.
• This fires on stable and exercises install.sh end-to-end. Catches install-script regressions.

Design notes

• install.sh runs dot init at the end; init requires an interactive QR scan and exits non-zero in headless CI — the step tolerates this with || true but hard-fails via ls -la if the binary itself was not installed (the real regression case).
• VERSION=<tag> pins the install to the just-released tag rather than racing the releases/latest CDN redirect.
• DOT_E2E_BINARY written to $GITHUB_ENV in a prior step so tilde/$HOME expansion works correctly when vitest reads it.

Test plan

• Manual: gh workflow run e2e-post-release.yml --ref ci/e2e-phase-7-post-release -f tag=<existing-stable-tag>
• First stable release: workflow fires automatically on release: published