fix(ci): stop executing tag-checkout code in the release smoke test

CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run
job runs in the default branch's cache scope, so checking out
workflow_run.head_sha and executing a script from it is a cache-poisoning
surface. The if-guard (event == 'push') already kept fork PRs out, but the
checkout pin was never the load-bearing part of the release verification —
the version argument is, since install.sh downloads that exact release
binary. Run the smoke script from the default branch instead, which also
matches what real users execute.

.github/workflows/smoke.yml

@@ -2,8 +2,13 @@ name: Deploy Smoke Tests
 
 # Container smoke test for the unattended (cloud-init) install path.
 # Runs when the install/deploy assets change on a branch push or PR, and
-# again after a release-tag build finishes uploading its assets — pinned to
-# that tag, so the green result verifies the release actually being shipped.
+# again after a release-tag build finishes uploading its assets — passing the
+# tag as an explicit version, so the green result verifies the release
+# actually being shipped. That job deliberately runs the script from the
+# default branch rather than checking out the tag: workflow_run executes in
+# main's cache scope, so executing checked-out code there is a cache-poisoning
+# surface (CodeQL actions/cache-poisoning/poisonable-step), and users pipe
+# main's install.sh anyway.
 # Tag pushes must NOT trigger the unpinned job directly: at that moment
 # releases/latest still points at the previous release (#5756), and a `paths`
 # filter alone cannot exclude them because a brand-new tag ref has no diff
@@ -58,8 +63,6 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
       - name: Pinned release install smoke test
         env:
           XUI_SMOKE_VERSION: ${{ github.event.workflow_run.head_branch }}