ci(release): test and smoke every shipped architecture natively

[ShortArrow]

Summary

Closes the "cross-published but never executed" gap: until now linux-arm64, win-arm64, and osx-x64 binaries (and the arm64 container half) shipped without ever having been run.

• Publish matrix goes native. Each RID now builds, tests, and runs on a runner of the same OS/arch: ubuntu-24.04-arm, windows-11-arm, and macos-15-intel join the matrix (all free for public repos).
• Published-binary smoke. Each matrix job executes the published self-contained ivicli --version and checks it reports the tag-derived version — a bad RID mapping or single-file bundling fault now fails the release, not the user.
• arm64 container smoke. New docker-smoke-arm64 job runs the HEALTHCHECK + SCPI round-trip natively on arm64; the multi-arch push now gates on both architectures. No QEMU (emulated .NET is slow/flaky).
• Tidy: the container smoke script existed in triplicate (pr-docker-smoke.yml + release.yml + would-be arm64 copy); extracted to docker/smoke-test.sh.
• ADR 0016 (Cross-Platform Policy) — previously a Draft/TBD stub — is now Accepted, documenting the guarantee; ADR 0018 §9 updated in place.

Verification

• Workflow YAML parses cleanly.
• ivicli --version output format confirmed locally (0.2.8+<sha> — prefix-matches the tag version).
• The release-path changes themselves can only be fully exercised by the next v* tag; pr-docker-smoke.yml (touched here via the shared script) will run on this PR because docker/** changed.