Examples Smoke doesn't trigger on release-code changes — broaden path filters + add a backstop #576

Problem

.github/workflows/examples-smoke.yml runs releasekit release --dry-run against shipped example configs — its whole job is to catch regressions in release behavior. But it only triggers on:

paths:
  - examples/**
  - scripts/examples-smoke/**
  - .github/workflows/examples-smoke.yml

Those are the smoke's inputs (examples + harness). The code under test — packages/** — is not in the list. So a regression in release logic never runs the smoke.

That's exactly how #575 happened: #482 (skip private npm packages by default) broke the npm-single fixture in packages/version, but since it didn't touch a smoke path, the smoke didn't run. It sat green-because-not-run from ~2026-06-23 until PR #574 (comments only) incidentally edited a scripts/examples-smoke/** file and re-triggered it — weeks later.

Fix

The workflow is generated — edit the trigger paths in scripts/examples-smoke/generate-smoke-workflow.ts, then pnpm examples:smoke:generate (CI's examples:smoke:check enforces no drift).

1. Add the code-under-test to the path filters (push + pull_request): packages/**, plus package.json / pnpm-lock.yaml (a dependency bump can change release behavior too). Now any release-affecting change re-runs the smoke before merge.
2. Backstop: scheduled run on main. A nightly schedule: catches anything the path filter still misses (transitive dep changes, runner/image drift) within a day.
3. Optional, strongest: gate the release workflow on a green smoke so a broken release tool can't ship. (Weigh against smoke flakiness before adopting.)

Cost note

Adding packages/** means the smoke runs on most PRs. It builds tarballs + runs 6 dry-run scenarios (seconds each) — acceptable for a release-critical tool, but if PR-time cost is a concern, the fallback is nightly-cron-only (slower feedback, still far better than path-gated-to-inputs).

Relation

• Examples Smoke broken: npm-single fixture is private, skipped since #482 → "No packages found" #575 fixes the current breakage (the private npm-single fixture).
• This issue prevents recurrence by making the smoke actually run when release code changes.