ops(ci): add phase6 smoke automation and CI workflows

docs/ops/ci_smoke.md

@@ -0,0 +1,59 @@
+# CI Smoke: Phase-6
+
+## Workflows
+- `.github/workflows/phase6-smoke.yml`
+  - `workflow_dispatch`: manual smoke run on NODA1 via SSH.
+  - `workflow_call`: reusable smoke step for deploy workflows (recommended for hard gate).
+  - `workflow_run`: auto-run after successful deploy workflows:
+    - `Deploy Node1`
+    - `deploy-node1`
+    - `deploy-node1-runtime`
+- `.gitea/workflows/phase6-smoke.yml`
+  - `workflow_dispatch`: manual smoke run for Gitea Actions.
+  - `workflow_run`: auto-run after deploy workflows in Gitea.
+
+## Required Secrets
+- `NODA1_SSH_HOST`
+- `NODA1_SSH_USER` (optional, defaults to `root` if empty)
+- `NODA1_SSH_KEY`
+
+## Manual Run
+1. Open Actions (`GitHub` or `Gitea`) -> `phase6-smoke`.
+2. Click `Run workflow` / `Run`.
+3. Optionally override `ssh_host` and `ssh_user`.
+4. Run and wait for the `phase6-smoke` job result.
+
+## On-Deploy Run
+- Triggered automatically only when configured deploy workflow finishes with `success`.
+- Job retries once on transient failures (SSH/network hiccups).
+- If smoke still fails, workflow is marked failed.
+- For strict deploy gating in the same pipeline, call this workflow via `workflow_call` from deploy workflow and set `needs`.
+  In Gitea, use same-workflow `needs` gate (or `workflow_run` from deploy workflow) because `workflow_call` support depends on runner/version.
+
+Example (`.github/workflows/deploy-node1.yml`):
+```yaml
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "deploy..."
+
+  smoke:
+    needs: [deploy]
+    uses: ./.github/workflows/phase6-smoke.yml
+    secrets:
+      NODA1_SSH_HOST: ${{ secrets.NODA1_SSH_HOST }}
+      NODA1_SSH_USER: ${{ secrets.NODA1_SSH_USER }}
+      NODA1_SSH_KEY: ${{ secrets.NODA1_SSH_KEY }}
+```
+
+## Artifacts
+- `phase6-smoke-logs` artifact includes:
+  - `phase6-smoke.log`
+  - per-attempt logs (`phase6-smoke-attempt1.log`, `phase6-smoke-attempt2.log` when retry happened)
+
+## Troubleshooting
+- `Missing SSH host`: add `NODA1_SSH_HOST` secret or pass `ssh_host` input.
+- `Missing secret NODA1_SSH_KEY`: add deploy key secret.
+- SSH host key issues: workflow uses `StrictHostKeyChecking=accept-new`; if host changed, rotate known host entry and retry.
+- Remote smoke fail: open artifact logs and check `/opt/microdao-daarion` state on NODA1.