A Hackage candidate is installed and tested as a downstream consumer before publish

## Summary

Add a job that consumes the freshly uploaded Hackage candidate the way a
downstream user would — resolve it from the real index, build it, run its tests
— and gate publish on that job passing.

## Motivation

A candidate is uploaded and then nothing touches it. Every check in `ci.yml`
runs against the repo's own sdist with the repo's `cabal.project`, which is not
the same as a stranger typing `cabal install collection-json`. The failures that
survive CI and only appear post-publish are exactly the resolution ones:
bounds that don't solve against the current index, a missing `extra-source-file`,
metadata Hackage accepts but consumers choke on.

Under #161 this becomes load-bearing rather than nice-to-have. Once merging the
release PR carries through to publish unattended, this is the last gate before an
irreversible upload, and the only one that tests the artifact as published rather
than as built.

## Scope

- After the candidate upload succeeds, in a clean checkout-free workspace,
install the package from the candidate URL and build it against a current
Hackage index.
- Run the package's own test suite from that installation.
- Make `publish` depend on this job.
- Decide the GHC set to smoke-test against — probably the matrix ends rather than
all five, since this runs on every release.

## Acceptance criteria

- [ ] The candidate is resolved and built from Hackage, not from the working tree.
- [ ] A package whose published bounds fail to solve is caught here, before publish.
- [ ] `publish` cannot run when the smoke test failed.

## Additional context

- Piece of the pipeline tracked in #161.
- Pairs with the candidate-promotion issue: this verifies the artifact, that one
ensures the verified artifact is what ships.

Start by reading ci.yml and locating the candidate-upload and publish steps, then trace how the release workflow passes data between jobs. Add a clean downstream smoke-test job using the candidate URL and make publish depend on it; done means the artifact is resolved from Hackage, built and tested, and a failed smoke test blocks publishing.

索引モデルが issue の本文から書いたものです。