Plugin pack CI workflow templates never verified green against an empty target repo — three stacked defects on first product use

## Summary

The vsdd-factory plugin pack ships a `.github/workflows/ci.yml` template (rust profile, at minimum) that is installed verbatim into a target product repo at pack-init time. The pack itself has no smoke-test / golden-empty-repo CI lane that asserts the shipped workflow runs green against a freshly-initialized empty target. As a result, the first product to use the pack inherited **three stacked defects** at P3-01, requiring a multi-PR rework chain (PR #3 → PR #4 → PR #5 on ArcavenAE/akey) before the CI baseline could pass.

## The three defects observed on akey (pack commit `6449e80`)

| Defect | Description |
|---|---|
| Stale action SHAs | `Swatinem/rust-cache`, `EmbarkStudios/cargo-deny-action`, etc. pinned to obsolete SHAs that no longer exist or have changed contract |
| Wrong runner OS for cargo-deny-action | Job set `runs-on: macos-latest`, but `cargo-deny-action` is a Docker container action and requires Linux. Container actions fail on macOS runners |
| No workspace-presence guard | The deny job assumed `Cargo.toml` was present at repo root; on a fresh target with the workspace-scaffold PR not yet merged, the deny job hard-fails |

All three were latent — they don't manifest in pack development (the pack repo itself doesn't run the shipped workflow against an empty product). They only surface when the first real product tries to consume the workflow.

## Root cause hypothesis

The pack's own CI exercises pack-internal tests but does not stand up a `tmp/golden-empty-product/` repo, initialize it with the pack at pack-HEAD, run the same workflow that gets shipped, and assert green. Without that lane, any drift between the shipped templates and the assumed product shape goes unnoticed until a user pays for it.

## Reproduction

1. Take any vsdd-factory pack version since the rust profile was added.
2. Initialize a fresh empty GitHub repo with the pack's `init` flow.
3. Push the resulting `.github/workflows/ci.yml` and watch the CI run.
4. Before the user adds a Cargo workspace, observe deny / clippy / build / test failures with no clear path to remediation; observe stale-SHA warnings; observe macOS-runner failures.

## Suggested fix shape

Add a CI lane in the vsdd-factory repo (`ci-pack-smoketest.yml` or similar) that:

1. Creates a tempdir, runs `git init`, runs the pack's `init` on it for each profile (rust, ts, etc.).
2. Optionally seeds a minimal workspace (one placeholder crate / one package.json).
3. Invokes the shipped workflow with `act` or via a real PR against a golden-empty-product fixture repo.
4. Asserts every job exits 0.

The same lane would have caught all three akey defects before the pack release.

## Severity

**P1 — high cost on first product use.** Every new product onboarded to vsdd-factory pays this tax until the pack is fixed; the cost is days of triage + multiple PRs against an empty repo before any feature work begins.

## Cross-references

- #343 / #346 / #347 / #348 / (new protection-context mismatch issue) — all surfaced in the same akey P3-01 cycle
- akey HANDOFF-PHASE-3-ENTRY.md §PG-3