Gate releases on the smoke-test suite

Summary

The smoke suite (smoke-tests.yml) is workflow_dispatch-only — deliberately, since each scenario stands up a full docker-compose cluster and is too heavy for PRs. But the release path (publish-dockerhub.yml, triggered on pushes to main and v* tags) validates the image with nothing more than a -h output check before pushing to Docker Hub. A functionally broken image can ship.

Proposed change

Run the smoke suite automatically for releases and block publishing on it:

• Convert smoke-tests.yml into a reusable workflow (workflow_call) and invoke it from publish-dockerhub.yml as a gate before the push-by-digest steps, at least for v* tags.
• Pass the locally built image through (the smoke workflow currently rebuilds pluto:local itself) so the exact artifact being published is what gets tested.
• Keep the very_large scenario excluded, as the manual workflow already does.

Acceptance

Pushing a v* tag runs the smoke scenarios against the image being published; a firing alert in any scenario fails the workflow and nothing is pushed.