fix(smoke): derive the clipboard assertion from what pi declares

v1.10.0's first tag build (run 704) failed on ONE assertion out of 104, and
published nothing. The assertion was wrong, not the image.

scripts/smoke-test.sh required @mariozechner/clipboard to be installed and
require()-able at every install site, failing hard when the family was absent.
pi 0.86.0 (#9163) "Replaced the external native clipboard dependency with
bundled asynchronous macOS, Windows, and X11 helpers while preserving platform
command and OSC 52 fallbacks". Measured in the published tarballs rather than
inferred from the changelog:

  pi 0.85.1 -> dependencies include @mariozechner/clipboard@0.3.9
  pi 0.87.1 -> no @mariozechner/* at all
  pi 1.0.0  -> no @mariozechner/* at all

So on a correct v1.10.0 image the package is legitimately gone, `if [ -z
"$sites" ]; then exit 1` fired, and both smoke jobs went red on the same line:
smoke 100 passed/1 failed, smoke-studio 103 passed/1 failed with every
studio-specific assertion green. build-variant, build-variant-studio,
promote-base-latest and update-description all skipped -> nothing published.
The gate worked; it was enforcing pi 0.85.1's dependency graph.

The guard is NOT deleted, because its "fail when absent" shape is the thing
that stops prune_foreign_natives() from deleting the binding instead of the
surplus platform copies. It now derives the expectation from what the image's
pi actually DECLARES:

  declares + install loads     -> pass
  declares + no install        -> FAIL (prune removed function)
  does not declare + no install-> pass (pi bundles it since 0.86.0)
  does not declare + install   -> FAIL (orphan nothing depends on)

That re-arms automatically if a future pi re-adds the dependency, which a
skip-if-absent would not.

Verified as that four-quadrant truth table on EXIT CODES, not messages, since
run() keys on status: rc=0/1/0/1 as listed. The final check extracted the
command string verbatim from the committed file and ran it through `sh -c` the
way run() does, so the escaping was tested as shipped rather than as drafted.

Gates: doc-drift 23 OK / 0 DRIFT; base-hash, workflow-shell, skill-floor,
lint-shell all rc=0. smoke-test.sh is not a base-hash input, so the base layer
does not rebuild.

CHANGELOG.md

@@ -209,6 +209,38 @@ jump, four new base packages and a new mailbox feature. The release carrying a
 
 ### Fixed
 
+- **The smoke suite asserted a pi dependency that upstream deleted, and it cost
+  this release its first tag build** — `scripts/smoke-test.sh` required
+  `@mariozechner/clipboard` to be installed and `require()`-able at every install
+  site. pi **0.86.0** (`#9163`) *"Replaced the external native clipboard
+  dependency with bundled asynchronous macOS, Windows, and X11 helpers while
+  preserving platform command and OSC 52 fallbacks"*. Measured in the published
+  tarballs: pi `0.85.1` declares `@mariozechner/clipboard@0.3.9`; `0.87.1` and
+  `1.0.0` declare no `@mariozechner/*` at all. So on a correct v1.10.0 image the
+  package is legitimately absent, the assertion's `if [ -z "$sites" ]; then exit
+  1` fired, and run 704 ended **100 passed / 1 failed** on `smoke` and **103
+  passed / 1 failed** on `smoke-studio` — same single assertion, every
+  studio-specific check green. `build-variant`, `build-variant-studio`,
+  `promote-base-latest` and `update-description` were all skipped, so **nothing
+  was published**: the gate behaved exactly as designed, against a stale
+  expectation rather than a real defect.
+
+  The fix does not delete the guard, because the guard was right: "fail when the
+  family is absent" is what stops `prune_foreign_natives()` from silently
+  deleting the binding instead of the surplus platform copies. It now **derives
+  its expectation from what the image's pi actually declares** — if pi declares
+  the dependency an install must exist and load; if pi does not, no install may
+  linger. That re-arms by itself should a future pi re-add it, and it still
+  catches an orphaned install. Verified as a four-quadrant truth table with the
+  command string extracted verbatim from the file and run through `sh -c` the way
+  `run()` invokes it: declared+present → rc=0, declared+absent → rc=1,
+  undeclared+absent → rc=0, undeclared+present → rc=1.
+
+  Worth stating plainly, since it is the whole value of the round: pi 1.0.0,
+  pi-atelier v0.13.0 and pi-studio v0.9.61 passed **103 of 104** assertions on a
+  pi MAJOR bump. The one red was the suite describing pi 0.85.1's dependency
+  graph, not the image.
+
 - **`git push` from inside the container dies on a read-only ControlPath, and no
   amount of documentation was fixing it** — `entrypoint-user.sh` now sets
   `core.sshCommand` to `ssh -F $HOME/.ssh-local/config` when that sidecar exists.