fix(ci): unbreak workflows + harden installer/release binaries

[KitsuneKode]

What changed

Unbreaks CI/release/build-binaries (broken since the setup-bun-monorepo composite nested checkout), adds native OS smoke for release binaries, and hardens installer/release asset handling so empty GitHub Releases stop silently breaking install.sh / install.ps1.

Root cause (the “crazy all-OS build” failures)

Every job using ./.github/actions/setup-bun-monorepo failed in ~6–10s with:

Can't find 'action.yml' … Did you forget to run actions/checkout before running your local action?

GitHub resolves local composite actions from the workspace before any step runs. Nesting actions/checkout inside the composite never works — the action isn’t on disk yet. That landed in f49fde93 (2026-06-27) and has been failing CI, Release, and the weekly 8-target build ever since.

Secondary installer pain: v0.2.5 (latest) has zero binary assets, so the default curl | bash / irm | iex path 404s. The binaries job never ran after the CI break, and there was no post-upload assert.

Fixes in this PR

• Checkout before every setup-bun-monorepo use; composite only does Bun + caches + install
• build-binaries.yml: native smoke matrix (ubuntu / macos / windows) after the 8-target cross-compile
• Release upload: fail_on_unmatched_files: true + assert ≥9 assets on the published tag
• install.sh / install.ps1: clearer empty-release errors; install.ps1 no longer returns after mpv (yt-dlp was unreachable)
• Docs gate: accept summary-only .release/*.json artifacts (v0.2.6 has empty sections)
• Docs: checkout hard rule, empty-release backfill, user-facing 404 guidance

Checklist

• Changeset added (bun run changeset) — required for user-facing CLI changes; N/A for docs-only or non-release infra
• bun run guard passes when apps/cli/package.json, changelogs, or .changeset/** changed
• bun run fmt && bun run lint && bun run test && bun run typecheck passes locally
• bun run build passes for feature, playback, provider, release, or packaging-sensitive changes
• Live provider or Discord smokes were skipped intentionally, or run manually with results noted

Follow-up (not in this PR)

After merge, re-run Release (or manually gh release upload for v0.2.5 / publish v0.2.6) so releases/latest actually has binaries again. Until then, users should use npm/bun global install.