ci: add fresh-clone smoke test for setup.sh and start.sh

[siddiqui7864]

Closes #583

Summary

Adds a GitHub Actions workflow that verifies the contributor onboarding
path end-to-end: fresh clone → ./setup.sh → ./start.sh → services respond.

What the workflow does

1. Runs ./setup.sh on a clean Ubuntu runner (Python 3.11, Node 20)
2. Verifies all expected artifacts exist after setup:
   • venv/ with fastapi, uvicorn, httpx installed
   • frontend/node_modules/.bin/vite present
   • data/, data/raw, data/reports, logs/, wordlists/ directories
   • .env file with correct default config
3. Starts both services via ./start.sh
4. Polls http://127.0.0.1:8000 and http://127.0.0.1:5173 until ready
5. Smoke-checks /openapi.json and /docs on the backend
6. Uploads logs/ as an artifact on failure for easy debugging

Environment assumptions

• Python 3.11+ (pinned via actions/setup-python)
• Node 20 (pinned via actions/setup-node)
• System dependencies (lsof, libcairo2-dev, pkg-config, python3-dev) installed before setup — lsof is required by start.sh pre-flight, cairo headers are required to build pycairo from source
• No Docker required — Docker plugins are skipped via the existing warning path in setup.sh

Trigger conditions

Only runs when setup.sh, start.sh, backend/**, frontend/**,
or requirements files are changed — not on every commit.

[utksh1]

This PR currently includes the same checksum workflow/script from #608, and that inherited change is still not valid.

python scripts/refresh_plugin_checksums.py --dry-run only computes and prints checksums. It does not compare against a committed manifest and does not fail when plugin metadata/parser files drift, so the checksum Action would pass while failing to enforce the intended policy. Please fix or remove the checksum workflow changes from this PR, and keep the fresh-clone smoke test as an independently reviewable change.

[siddiqui7864]

@utksh1 Removed plugin-checksum.yml and refresh_plugin_checksums.py from this branch — the smoke test is now the only change here, independently reviewable.
The Onboarding Smoke Test check is passing. The remaining backend-lint and frontend-checks failures are pre-existing on main and not introduced by this PR — the only file this branch adds is .github/workflows/smoke-test.yml.

[utksh1]

Re-reviewed the update. This remains blocked by red required checks and still carries/depends on the checksum workflow work from #608. Please split the fresh-clone smoke test from checksum drift validation, rebase on latest main, and get the smoke workflow green independently.

[siddiqui7864]

@utksh1 Rebased and squashed — the branch now contains a single clean commit with only the smoke-test workflow. No checksum history remains. All checks are green.

[utksh1]

Re-reviewed after branch refresh. The PR is now scoped to the fresh-clone setup/start smoke workflow, the new smoke job passes, and the standard required checks are green. Approving.