ci(docker): smoke-test the image before publishing it

The deploy job now builds the native amd64 image locally (--load) from the
downloaded artifact and runs the smoke test before pushing anything, so a broken
image can never reach the registry. The build job's smoke test can't catch
artifact-level issues (e.g. the executable bit lost through the artifact
round-trip) because it builds the binary locally, not from the artifact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gwleclerc

Makefile

@@ -237,6 +237,14 @@ deploy-docker:
 	# Assemble and push the multi-arch image from the pre-built binaries. No compilation and no
 	# QEMU: every target stage is COPY-only (the cert stage runs on the build platform).
 	docker buildx create --use
+	# Smoke-test BEFORE publishing anything: build the native amd64 image locally (--load) from the
+	# exact downloaded artifact — which has lost its executable bit through the GitHub artifact
+	# round-trip — then run it and check it serves. Nothing is pushed unless this passes, so a
+	# broken image can never reach the registry (the build job's smoke can't catch this: it builds
+	# the binary locally, never from the artifact).
+	docker buildx build --load --platform linux/amd64 --tag $(DOCKER_IMAGE):$(DOCKER_TAG) .
+	$(MAKE) start-docker smoke-docker
+	docker rm -f $(APPNAME) >/dev/null 2>&1 || true
 ifdef IS_SEMVER
 	docker buildx build --push --platform $(DOCKER_PLATFORMS) --tag $(DOCKER_IMAGE):latest .
 endif