ci: smoke-test compiled binary on Linux + Windows

[stack72]

Summary

Compiling proves the binary builds; this confirms it actually boots. Adds a step after `deno task compile` that runs `--version` and `--help` against the produced binary on both matrix legs. Catches runtime regressions (e.g. a top-level import that throws on load, a missing command registration) that the compile step alone doesn't surface.

Both commands run without a repository, so the smoke test is hermetic and adds no I/O. `--help` is piped to /dev/null since the output is verbose.

Confirmed locally on macOS:

```
$ ./swamp --version
swamp 20260206.200442.0-sha.
$ ./swamp --help > /dev/null
--help exited 0
```

Test plan

• Smoke commands exit 0 locally
• CI run on this PR confirms both commands work on the produced Linux + Windows binaries

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None — this is a clean, minimal addition. The smoke test step is correctly placed after deno task compile, handles the Windows/Linux binary name difference via $RUNNER_OS, explicitly sets shell: bash for cross-platform consistency, and pipes --help to /dev/null since only the exit code matters. No secrets, no untrusted input, no injection surface. Good catch on the gap between "it compiles" and "it boots."

[github-actions]

CI Security Review

Critical / High

None.

Medium

None.

Low

None.

Verdict

PASS — The change adds a simple bash smoke-test step (--version and --help) to the existing test job. No GitHub Actions expressions are interpolated in run: blocks, no new actions are introduced, no secrets are referenced, no permissions are changed, and no triggers are modified. This is security-neutral.