[MarcelT87]

Summary

Add a contributor-style smoke test that runs the public workflow from a second, freshly cloned checkout instead of relying only on the Actions workspace.

This is intended as the final outside-contributor-like release-readiness check before rc2.

Fresh-checkout workflow

The new contributor-smoke job:

1. checks out the source under test with credentials disabled;
2. creates a second clean clone under /tmp;
3. verifies that clone is on the exact tested commit and starts without .venv, data/ or the generated launcher;
4. runs bash install.sh;
5. runs the public static workflow:
   • doctor;
   • import;
   • status;
   • export;
   • verify;
   • verify --submission;
6. verifies the copied raw source remains byte-for-byte unchanged;
7. exercises common malformed-input cases:
   • missing raw-log path;
   • invalid ZIP passed to verify;
   • corrupt local evidence state;
8. requires those malformed inputs to be reported without Python tracebacks;
9. restores the valid state and proves the workflow remains usable;
10. verifies the fresh checkout is still source-clean.

Scope

CI/release-readiness only.

No runtime, parser, Evidence, profile, bundle, installer or submission behaviour changes.