test(release): boot a board built from the packages just published

[jouwdan]

0.21.0 was cut to fix a board that rendered raw message keys and had no CSS. It shipped with only the first of the two fixes.

A stacked PR merged into a base that had already merged, so its commits never reached main. Nothing noticed — main was green, the tag was coherent, the packages published, and the release notes described a fix that was not in them. It was caught by grepping main by hand before re-pinning the Vercel template:

$ git show origin/main:apps/community/bin/forum-web.mjs | grep -c BOARD_PACKAGES
0

The self-host template drifting three versions behind, serving that same bug to anyone clicking "Use this template", was the same shape (MEI-136).

Every gate in this repository examines the repository. None look at what a user downloads.

What this adds

scripts/published-board-smoke.mts scaffolds with npx create-meith@$MEITH_VERSION — from the real registry, not from packed tarballs or anything in this tree — installs, and boots at both materialization depths, with the same three assertions the workspace smoke makes: renders <main>, no message key reaches the page as text, and the stylesheet carries rules for classes only the installed packages produce.

It runs as a release job after npm, and publish now waits on it:

versions → build → npm → published-board → publish
                      ↘ base-image      ↗

It cannot un-publish a bad version, and is not meant to. What it can do is stop the release being announced and tell you within minutes, rather than after somebody deploys it. Both failures above would have been caught.

The shared module

The boot and its assertions move to scripts/board-boot-check.mts, used by both smokes. Without that the published smoke would drift into a weaker check than the one it exists to mirror — which is exactly the failure mode this week has been about. board-workspace-smoke.mts loses 86 lines and gains nothing else.

Verification

The new job was run for real, against the live 0.21.2 packages on npm — not simulated, not reasoned about:

== scaffolding from create-meith@0.21.2 on the real registry ==
== the board materialized at .meith/app rendered / ==
== every class the board rendered has a rule ==
== a second published board, materialized the way Vercel deploys it ==
== the board materialized at the project root rendered / ==
✓ published-board-smoke: a board built from the published 0.21.2 packages boots

The existing smoke passes unchanged against the refactored module, both depths — the regression that mattered, since this moved code it depends on:

== the board materialized at .meith/app rendered / ==
== the board materialized at the project root rendered / ==
✓ board-workspace-smoke: a scaffolded, externally-installed board builds and boots

Also: npx tsc --noEmit clean; docs:links:check and ci:parity:check pass; biome clean; release.yml parses and the job graph is as drawn above.

Both local runs used PGlite over the wire protocol, since this box has no Docker — CI uses a real postgres:18-alpine.

Fixes MEI-137.