fix(ci): pin the tag smoke test to the release under test

The v3.4.2 tag push triggered the smoke workflow immediately, but
install.sh with no arguments resolves releases/latest, which still pointed
at v3.4.1 while release.yml was uploading the new assets. The green smoke
run therefore validated the previous release (#5756). A paths filter alone
cannot exclude tag pushes because a brand-new tag ref has no diff base.

Restrict the push trigger to branches so tag pushes no longer start the
unpinned job, and add a workflow_run job that fires after the release
workflow completes for a v* tag: it checks out the tagged commit, passes
the tag through smoke-noninteractive.sh into install.sh's explicit-version
path, and asserts the installed binary reports exactly that version.

Closes #5756

.github/workflows/smoke.yml

@@ -1,10 +1,18 @@
 name: Deploy Smoke Tests
 
 # Container smoke test for the unattended (cloud-init) install path.
-# Runs only when the install/deploy assets change.
+# Runs when the install/deploy assets change on a branch push or PR, and
+# again after a release-tag build finishes uploading its assets — pinned to
+# that tag, so the green result verifies the release actually being shipped.
+# Tag pushes must NOT trigger the unpinned job directly: at that moment
+# releases/latest still points at the previous release (#5756), and a `paths`
+# filter alone cannot exclude them because a brand-new tag ref has no diff
+# base, so it runs on every tag push.
 
 on:
   push:
+    branches:
+      - "**"
     paths:
       - "install.sh"
       - "deploy/**"
@@ -14,12 +22,16 @@ on:
       - "install.sh"
       - "deploy/**"
       - ".github/workflows/smoke.yml"
+  workflow_run:
+    workflows: ["Release 3X-UI"]
+    types: [completed]
 
 permissions:
   contents: read
 
 jobs:
   noninteractive-install:
+    if: github.event_name != 'workflow_run'
     strategy:
       fail-fast: false
       matrix:
@@ -30,3 +42,25 @@ jobs:
       - uses: actions/checkout@v7
       - name: Non-interactive install smoke test
         run: bash deploy/test/smoke-noninteractive.sh
+
+  release-tag-install:
+    if: >-
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      startsWith(github.event.workflow_run.head_branch, 'v') &&
+      contains(github.event.workflow_run.head_branch, '.')
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      - name: Pinned release install smoke test
+        env:
+          XUI_SMOKE_VERSION: ${{ github.event.workflow_run.head_branch }}
+        run: bash deploy/test/smoke-noninteractive.sh "$XUI_SMOKE_VERSION"