chore(S02/T05): Harden published smoke cleanup and capture the stale pu…

- scripts/verify-published-release.sh
- internal/release/published_release_smoke_contract_test.go
- .gsd/milestones/M004/slices/S02/published-release-smoke-evidence.md
- .gsd/KNOWLEDGE.md

Author: belyaev-dev

internal/release/published_release_smoke_contract_test.go

@@ -150,6 +150,11 @@ func TestPublishedReleaseSmokeContract(t *testing.T) {
 		"--version <tag-or-latest>",
 		"--install-kind <all|binary|docker|go-install|brew>",
 		"--chart-path <path>",
+		"cleanup() {",
+		"local exit_code=$?",
+		"chmod -R u+w \"$WORK_ROOT\" 2>/dev/null || true",
+		"warning: failed to clean work root %s",
+		"exit \"$exit_code\"",
 		"BREW_FORMULA=\"belyaev-dev/homebrew-tap/helmdoc\"",
 		"brew install \"$BREW_FORMULA\"",
 		"docker pull",

scripts/verify-published-release.sh

@@ -13,7 +13,16 @@ MODULE_PATH=$(awk '/^module / { print $2; exit }' "$REPO_ROOT/go.mod")
 TMP_ROOT=${TMPDIR:-/tmp}
 WORK_ROOT=$(mktemp -d "$TMP_ROOT/helmdoc-published-release.XXXXXX")
 GO_WORK_ROOT="$WORK_ROOT/go-install"
-trap 'rm -rf "$WORK_ROOT"' EXIT
+
+cleanup() {
+  local exit_code=$?
+  chmod -R u+w "$WORK_ROOT" 2>/dev/null || true
+  if ! rm -rf "$WORK_ROOT"; then
+    printf 'verify-published-release: warning: failed to clean work root %s\n' "$WORK_ROOT" >&2
+  fi
+  exit "$exit_code"
+}
+trap cleanup EXIT
 
 log() {
   printf 'verify-published-release: %s\n' "$*"