test: force the smoke gate to fail, to watch it block a publish

TEMPORARY, reverted in the next commit. Milestone 362's verification section
requires the gate to be seen rejecting a build — a gate nobody has watched
reject anything is a gate nobody knows is wired up. Every real check passes,
so the rejection has to be forced.

Under test is the job dependency, not the assertions: a failed smoke-web must
skip the promote job, and the three :latest tags must still name the digests
they named before the run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TTjbZZ6JirCMSaJzQV1RhA

.forgejo/workflows/build.yml

@@ -1214,6 +1214,18 @@ jobs:
           fi
           curl -fsS --max-time 5 "http://$WEB_IP:8080/api/health"
           echo
+
+          # >>> TEMPORARY — REVERTED IN THE NEXT COMMIT <<<
+          # Milestone 362's verification says the gate must be watched
+          # REJECTING a build before anyone can believe it is wired up. Every
+          # real check above passes right now, so the only way to see a
+          # rejection is to force one. What is under test here is the job
+          # dependency, not the assertions: does a failed smoke actually stop
+          # the promote, and does :latest stay where it was?
+          echo "smoke: FORCED FAILURE — verifying the gate blocks the promote" >&2
+          exit 1
+          # >>> END TEMPORARY <<<
+
           echo "smoke: all checks passed against $CANDIDATE"
 
   # Move the channel tags — the whole point of the gate.