#220 ci: add package-smoke-test job to catch wheel packaging bugs

[Anonymous]

Originally created by: QY-25123

Pull Request

Slice

• Repo: doberman-core | doberman-enterprise
• Feature / Slice: [#196] — ci: add a packaging smoke-test job (build + install the wheel)
• Plan reference: doberman_implementation_plan.md

What this PR does

CI only ever ran pip install -e ".[dev]" (editable install). A missing packages entry in [tool.hatch.build.targets.wheel], a broken [project.scripts] entry, or a file that only exists via the editable symlink would pass all CI checks and ship in a release undetected.
Adds a new package-smoke-test job that builds the real wheel with python -m build, installs it into a clean venv (no editable install, no dev extras), and runs doberman --version to prove the packaged CLI entry point works standalone. The existing test job is untouched. Closes [#196].

Tests added (run in CI)

• The package-smoke-test job is itself the verification — it fails the build if the wheel doesn't build, install cleanly, or run. No new test file is needed for a CI-plumbing change.

Public-release safety (doberman-core only)

• [x] Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code
• [x] Core still builds/tests/runs with NO enterprise package installed

Security checklist

• [x] Fails closed on error / uncertainty
• [x] No secret, full file, or unredacted prompt logged or committed
• [x] Any guardrail/learning change is raise-only (no silent loosening)
• [x] Every BLOCK/AUTH carries reason codes + a human explanation
• [x] doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

• build installed inline in the CI step only, not added to pyproject.toml dependencies
• Job runs ubuntu-latest / Python 3.12 only — packaging bugs aren't Python-version-specific
• Standalone-guarantee check, secret-scan job, and full test matrix are all untouched

[Anonymous]

Ticket changed by: fu351

• status: open --> closed