Release smoke tests that rebuild from source don't test the shipped binary

When cutting a release directory that contains both a source archive and a prebuilt binary (e.g. a .so plugin), check what the smoke test actually loads. In our case the test harness compiled its own plugin from the release tree's source, so a passing smoke said nothing about the shipped .so. The build flags, stripped symbols or compiled-out test hooks could all differ.

Fixes: - point the harness at the shipped artefact via an env var or explicit path; - assert the loaded path at runtime (log dladdr or /proc/self/maps); - record the binary's sha256 next to the test result.

Also run cheap static checks on the shipped binary itself: - nm -D for the expected exports; - strings | grep for test-only markers, to prove the hooks are compiled out.

Label the result honestly: 'source smoke passed', not 'release binary verified'.