test(selfhost): add beta smoke matrix and release checklist

[JSONbored]

Closes #1944

Summary

• The existing CI "build + boot smoke test" only exercises one fixed configuration (SQLite + Redis + direct-App mode) — there was no repeatable way to validate brokered mode, air-gapped mode, or any AI provider before cutting an RC image.
• scripts/smoke-selfhost.sh: a portable, mode-agnostic smoke script. Boots one container against a fresh Redis on an isolated network, waits for health, and asserts on /health, /ready, /metrics plus caller-supplied expected/forbidden startup log events (SELFHOST_SMOKE_EXPECT_EVENTS / _FORBID_EVENTS). Always asserts selfhost_migrations_applied regardless of mode.
• New docs page "Beta release checklist" walks through all six required scenarios (direct App, brokered, air-gapped, each AI provider, SQLite vs. Postgres, Redis + optional Qdrant RAG) with the exact env + smoke-script invocation for each, an expected-events table, and a known-warnings table distinguishing acceptable-in-beta from release-blocking (e.g. a failed relay registration is a warning in pull mode but fatal in push mode).
• Linked from the Releases & images page's prerelease section and added to the self-hosting nav under "Self-hosting: release & security".
• Drift-guard test (mirrors docs(ops): finish self-host rate-limit dashboards and runbooks #1943's pattern): every selfhost_* event name cited in the new doc and script is verified against the real console.log/error call sites in src/server.ts and src/selfhost/ai.ts.

No dedicated tests for the shell script

scripts/smoke-selfhost.sh is a manually-invoked operator tool (like the existing deploy-selfhost-image.sh/deploy-selfhost-prebuilt.sh, which also have no unit tests) — it boots real Docker containers and isn't unit-testable. Verified with shellcheck (clean) and the drift-guard test above, which does cover its cited event names.

Test plan

• shellcheck scripts/smoke-selfhost.sh — clean
• npm run ui:typecheck, npm run ui:lint, npm run ui:test, npm run ui:build — all clean
• npm run test:ci (full local gate, unsharded) — green, including the new drift-guard test
• npm audit --audit-level=moderate — 0 vulnerabilities
• Manually verified in a running dev server: new page renders all 6 scenario sections + expected-events + known-warnings tables, docs nav shows "Beta release checklist" under "Self-hosting: release & security", Releases & images page links to it

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	92b06c0	Commit Preview URL Branch Preview URL	Jul 03 2026, 01:18 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.09%. Comparing base (6ff28c4) to head (92b06c0).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2657   +/-   ##
=======================================
  Coverage   96.09%   96.09%           
=======================================
  Files         237      237           
  Lines       26472    26472           
  Branches     9602     9602           
=======================================
  Hits        25438    25438           
  Misses        425      425           
  Partials      609      609           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.