feat: prepare CASAN paid PoC release package

.gitea/workflows/casan-supply-chain.yml

@@ -15,6 +15,7 @@ jobs:
       CASAN_CI_RUN_FRONTEND: "1"
       CASAN_CI_RUN_BACKEND: "1"
       CASAN_CI_RUN_INFRA_LAB: "0"
+      CASAN_CI_RUN_CONTROL_PANEL: "1"
       CASAN_REQUIRE_LIVE_SCANNERS: "1"
       CASAN_TOOLCHAIN_TRUSTED_DIRS: /usr/bin:/bin:/usr/local/bin
     steps:

.gitea/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
     env:
       CASAN_CI_RUN_FRONTEND: "0"
       CASAN_CI_RUN_BACKEND: "0"
+      CASAN_CI_RUN_CONTROL_PANEL: "1"
       CASAN_CI_RUN_INFRA_LAB: "0"
       CASAN_CI_STEP_TIMEOUT_SEC: "1200"
     steps:
@@ -39,6 +40,9 @@ jobs:
           echo "tag=$TAG version-file=$FILE_VER"
           [ "$TAG" = "$FILE_VER" ] || { echo "::error::tag v$TAG != VERSION $FILE_VER — bump VERSION before tagging"; exit 1; }
 
+      - name: Install locked Node dependencies
+        run: npm ci
+
       - name: Verify governance gate (must be green to release)
         run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
 
@@ -52,6 +56,14 @@ jobs:
           scripts/package-release.sh enterprise || echo "enterprise skipped (future, expected)"
           ls -lh dist/
 
+      - name: Smoke extracted release artifacts
+        run: |
+          set -euo pipefail
+          scripts/smoke-release-artifact.sh "dist/casan-core-v$(cat VERSION).tar.gz"
+          scripts/smoke-release-artifact.sh "dist/casan-devkit-v$(cat VERSION).tar.gz"
+          CASAN_ARTIFACT_SMOKE_RUN_TESTS=1 \
+            scripts/smoke-release-artifact.sh "dist/casan-platform-preview-v$(cat VERSION).tar.gz"
+
       - name: Publish bundles to Gitea package registry
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}