Add smoke-test gate before PyPI publish in release workflow

Install the built wheel on each OS (ubuntu, macos, windows) and run
pytest before the publish job can proceed. This prevents shipping a
wheel that fails to import or has broken tests.

Author: nathanjmcdougall

.github/workflows/release.yml

@@ -136,13 +136,51 @@ jobs:
           path: dist/
           if-no-files-found: error
 
+  smoke-test:
+    name: Smoke test (${{ matrix.os }})
+    needs: [build-linux, build-macos, build-windows]
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        include:
+          - os: ubuntu-latest
+            artifact: wheels-linux-x86_64
+          - os: macos-latest
+            artifact: wheels-macos-aarch64
+          - os: windows-latest
+            artifact: wheels-windows-x64
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Download wheel
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ matrix.artifact }}
+          path: dist/
+
+      - name: Install wheel and test dependencies
+        run: |
+          pip install dist/*.whl
+          pip install pytest
+
+      - name: Run tests
+        run: pytest -v
+
   publish:
     name: Publish
     runs-on: ubuntu-latest
     permissions:
       id-token: write # for Trusted Publishing
     needs:
-      [build-sdist, build-linux, build-musllinux, build-macos, build-windows]
+      [build-sdist, build-linux, build-musllinux, build-macos, build-windows, smoke-test]
 
     environment: release