ci: smoke-test the shipped artifact on every platform

[jrosskopf]

The gap

Every job in this pipeline exercises build/release/duckdb — a shell with the extension statically linked in. That never loads the .duckdb_extension file users install, so nothing here can catch an artifact that builds green and then fails to instantiate.

Not hypothetical: quack-oauth's CLAUDE.md records its wasm side-module as "builds green but won't instantiate in the browser — a load-time failure CI can't see." Same gap, already known.

11 of 15 DataZoo extensions had no load verification at all. This is part of closing that fleet-wide.

What this adds

scripts/smoke_test.py downloads the official DuckDB CLI for the target version, installs the built artifact into it, loads it, and calls a real function:

Step	Catches
INSTALL	truncated artifact, wrong platform, wrong DuckDB version
LOAD + duckdb_extensions()	builds but will not instantiate
the smoke query	loads but functions do not work

The third step earns its place: loading proves the shared object resolves, not that its registered functions run — symbols can resolve lazily and only fail when called.

Wiring

needs: [build], with each deploy job taking the smoke job in its needs — a broken artifact on any platform now blocks distribution. Matrix: linux_amd64, osx_arm64, windows_amd64, honouring the build job's exclude_archs.

Verification

The smoke query was run against a real build of this extension, not read off the source. That mattered: three of the fleet-wide candidates were wrong when checked that way — anofox_stats_ols_fit takes X column-major, context_parse_json is a table function rather than a scalar, and context_serialize_json takes a query string.

Piloted in erpl-tunnel#3: six smoke jobs green across linux_amd64, osx_arm64, windows_amd64 on two DuckDB lines. The pilot also caught a real defect in the first draft — the arch gate was a job-level if: referencing matrix.arch, which is out of scope there; GitHub rejected the workflow at validation, producing a run with zero jobs and no logs that reads as "nothing failed". Fixed by gating at step level before this was propagated.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}