ci: smoke workflow runs post-deploy mvp suite on push to main (#126)

Was marked out-of-scope in the original #126 issue body, but it is the
operational link that closes the deploy loop -- without it, operators
have to remember to run pnpm test:e2e by hand after every deploy.

.github/workflows/smoke.yml
- Triggers: push to main, plus manual workflow_dispatch with an
  optional include_cost boolean for the @cost-tagged tests
  (Anthropic + Resend charges).
- 5-minute timeout. Default run skips @cost via --grep-invert.
- Uploads the playwright-report artifact on failure (7-day retention).
- Uses INCLUDE_COST as an env var rather than ${{ inputs.* }} inline,
  per the workflow-injection guidance.

Sequencing
- This workflow runs against the deployed production URL
  (default https://rafters.studio per playwright.config.ts), so it
  fires AFTER wrangler deploy. Order on push to main:
  1. CI workflow runs typecheck + unit tests
  2. (Operator) wrangler deploy from local
  3. Smoke workflow fires (also on push) and exercises the deployed
     worker
- If a smoke run fires before the deploy lands, it will fail against
  the prior version. That is correct behavior -- a deploy hasn't
  happened, so the new code isn't live, so the smoke should report
  the gap.

Out of scope
- Auto-deploy from CI (operator-controlled)
- Slack / PagerDuty notification on failure
- Smoke against staging (single env for MVP)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ssilvius

.github/workflows/smoke.yml

@@ -0,0 +1,57 @@
+name: Smoke
+
+# Runs the post-deploy MVP smoke suite (#126) against production after every
+# push to main. Default run skips @cost-tagged tests (Anthropic + Resend
+# charges); operators run those manually with --grep @cost.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      include_cost:
+        description: "Run @cost-tagged tests (real Anthropic + Resend charges)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: |
+          mkdir -p "$(pnpm bin)"
+          printf '#!/bin/sh\nexit 0' > "$(pnpm bin)/lefthook"
+          chmod +x "$(pnpm bin)/lefthook"
+          pnpm install --frozen-lockfile
+
+      - run: pnpm exec playwright install --with-deps chromium
+
+      - name: Smoke
+        env:
+          INCLUDE_COST: ${{ inputs.include_cost }}
+        run: |
+          if [ "$INCLUDE_COST" = "true" ]; then
+            pnpm test:e2e
+          else
+            pnpm test:e2e --grep-invert @cost
+          fi
+
+      - if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 7