test(smoke): make CI prove the natives still work — the runbook check didn't

The post-boot check v1.9.1 left for the next machine was

  node -e 'require("esbuild").transformSync("const x:number=1",{loader:"ts"})'

with "if this fails, the prune removed something needed on arm64 -> revert to
v1.8.14 and fix" attached. Run from /workspace on the freshly recreated v1.9.1
image it fails with MODULE_NOT_FOUND — on a perfectly healthy image. require()
resolves by walking up from the CURRENT DIRECTORY, esbuild is nested inside the
two pi trees, and a global install is not on node's require path (NODE_PATH is
unset). The version that "verified the prune" last night only passed because the
shell happened to sit inside the tree. So the check was CWD-dependent, its red
meant nothing, and the remedy it prescribed was reverting a good release.

Path-qualified, both sites compile TS today. Rather than leave a fragile command
in a note for a human to paste, CI now owns it:

  - esbuild must transformSync at EVERY install site found in the image
  - @mariozechner/clipboard must load with its native binding attached at every
    site — for the clipboard prune that IS the proof, since napi-rs resolves the
    platform package at require() time

Sites are discovered with find, so the studio variant's third site is covered
without naming it.

Verified as a four-way matrix, not just a green run: both assertions pass
against the real image FROM /workspace (the cwd that broke the old command), and
both fail (exit 1, "The package \"@esbuild/linux-arm64\" could not be found, and
is needed by esbuild") against copies of the same packages with the host
platform binary removed. An assertion never observed failing is not evidence.

Also documents both failure shapes in AGENTS.md next to the size gate: this one,
and the mode-700 /root one where `test ! -d` passes on a permission error.

scripts/smoke-test.sh

@@ -30,6 +30,7 @@
 #     client bundle present + registered via `pi install`
 #   - no foreign npm-11 platform packages (@esbuild, clipboard) beyond the host
 #   - no build-time npm cache (/root/.npm) shipped in the image
+#   - esbuild compiles + clipboard native loads at every install site
 #   - image size within threshold
 
 set -euo pipefail
@@ -909,6 +910,27 @@ run "no foreign platform packages (npm 11 sentinel)" \
 run "no build-time npm cache shipped (/root/.npm)" \
   'test "$(id -u)" = "0" || { echo "assertion needs root to read /root" >&2; exit 1; }; if [ -e /root/.npm ]; then echo "/root/.npm shipped: $(du -sm /root/.npm | cut -f1) MB" >&2; exit 1; fi; echo ok'
 
+# The prune's risk is not "too big" but "removed something needed", and only a
+# FUNCTIONAL check covers that. These load the natives from every install site
+# found in the image, so they also scale to the studio variant's third site.
+#
+# NOTE THE PATH-QUALIFIED require(). The obvious form, `node -e
+# 'require("esbuild")...'`, resolves by walking up from the CURRENT DIRECTORY —
+# so it fails with MODULE_NOT_FOUND from /workspace on a perfectly good image,
+# because esbuild lives nested inside the pi trees and global installs are not
+# on node's require path (NODE_PATH is unset). That exact command was left in a
+# runbook as "if this fails, revert the release", and it duly failed for the
+# wrong reason on the first machine that ran it. A check must fail only for the
+# thing it is checking.
+run "esbuild works at every install site (prune removed weight, not function)" \
+  'sites=$(find /usr/lib/node_modules /opt -type d -path "*/node_modules/esbuild" -prune 2>/dev/null); if [ -z "$sites" ]; then echo "no esbuild install found at all" >&2; exit 1; fi; for d in $sites; do node -e "require(\"$d\").transformSync(\"const x:number=1\",{loader:\"ts\"})" || { echo "esbuild broken at $d" >&2; exit 1; }; done; echo ok'
+
+# Clipboard is the family pruned second, and its napi-rs loader picks its native
+# binding at require() time — so a successful load IS the proof that the kept
+# platform package is the one this image needs.
+run "clipboard native loads at every install site" \
+  'sites=$(find /usr/lib/node_modules /opt -type d -path "*/node_modules/@mariozechner/clipboard" -prune 2>/dev/null); if [ -z "$sites" ]; then echo "no @mariozechner/clipboard install found at all" >&2; exit 1; fi; for d in $sites; do node -e "var c=require(\"$d\"); if (typeof c.setText !== \"function\") { throw new Error(\"native binding missing\"); }" || { echo "clipboard native broken at $d" >&2; exit 1; }; done; echo ok'
+
 # ── Image size ────────────────────────────────────────────────────────
 echo ""
 echo "── Image size ──"