ci(build): add CommandBox install->serve smoke leg for the ForgeBox path

[bpamiri]

What

Adds a CI leg (.github/workflows/commandbox-install-smoke.yml) that exercises the built ForgeBox/CommandBox install→serve journey on every PR that touches the build pipeline — the durability net for the path-repair campaign.

The ForgeBox channel was published but broke end to end and stayed broken undetected for weeks, because nothing in CI installs the built packages the way a CommandBox user does. ForgeBox publishing is stable-only and asynchronous, so a packaging regression only surfaces in production long after the offending commit lands. This leg closes that gap.

How

1. Builds the base + core packages from the tree (tools/build/scripts/prepare-base.sh + prepare-core.sh) — the artifact this PR would publish, not the lagging ForgeBox copy.
2. Stages them as box install wheels-base-template lands them: base scaffold at the app root, wheels-core at vendor/wheels/ per the box.json installPaths (satisfying the dependency from the local core build).
3. Boots under the ortussolutions/commandbox image (CommandBox is the runtime on this path, not LuCLI — same image/source as release.yml's ForgeBox publish) and asserts:
   • dev (no edits): server binds, GET / 200 (welcome), /wheels/info 200 (dev whitelist fix(public): whitelist /wheels/info JSON metadata and validate core.cfm format include #2988), clean URL /main/index 200, db/ ships, no |placeholder|/{{token}} survives.
   • prod: tools/ci/smoke-env.sh passes all six reload-gate / no-trace probes (same harness the Smoke workflow drives).

Pre-boot structural guards name the campaign's packaging defects (#3173 placeholders, #3174 db/, root-view generation) so a regression is reported precisely instead of as an opaque boot failure.

Gated on: tools/build/**, cli/lucli/templates/app/**, tools/ci/smoke-env.sh, and the workflow file.

Ordering — this leg gates on two sibling PRs merging

This leg tests the FIXED pipeline:

• The template keystone — Align the ForgeBox wheels-base-template with the LuCLI wheels new template (single source of truth) #3176 (build base template from cli/lucli/templates/app, sibling PR build(forgebox): rebuild base template from LuCLI template so box install boots clean #3196) — is not yet on develop. Until it merges, develop's prepare-base.sh still copies the repo-root demo app and ships cfengine:"|cfmlEngine|", so box server start hard-errors ("Invalid slug detected") and the connectivity probe fails. That is the defect this leg catches; the probes are deliberately not weakened to pass on the unfixed tree.
• The wheels-core fixes (wheels-core box.json double-nests installs: box install wheels-core in a wheels new app lands in vendor/wheels/vendor/wheels and never upgrades the running framework #3177/Release stamping clobbers PackageLoader's "@build.version@" sentinel — wheelsVersion constraint enforcement silently disabled on every released build #3178/ForgeBox wheels-core artifact ships internal docs/superpowers planning files (specs, PR drafts, patches) #3179) are already on develop (PR build(core): land wheels-core flat, protect version sentinel, drop internal docs #3194), so the core leg of the dependency is green now.

Once #3196 lands on develop, this job goes green.

Verification (local, CommandBox 6.3.3 / ortussolutions/commandbox:latest)

• Keystone composed (fixed tree): all six smoke-env.sh probes PASS in production (failures=0); dev journey passes (GET / 200, /wheels/info 200, /main/index 200, db/ present) with no edits. Validated inside a long-lived container mimicking the GHA container: — box server start daemonizes and persists across steps.
• Unfixed develop artifact: container exits 1 with Invalid slug detected. Slugs can only contain letters, numbers, underscores, and hyphens — boot status 000. The gate is real.

The PR contains only the workflow file; the sibling-branch changes were composed locally for verification and then reset.

Refs #3173, #3174, #3176, #3177 (durability net)
Closes #3201

🤖 Generated with Claude Code