ci: harden Linux artifact --version test (drop || true)

[lqdev]

Goal

The test-builds job in .github/workflows/release.yml currently masks Linux artifact-startup failures with ./podcast-tui --version || true. This makes the test largely non-actionable: a broken binary still passes the job. Replace || true with a real assertion, while staying tolerant of known unsupportable runner environments.

Surfaced by Copilot review on PR #199; deferred there to keep that PR focused on Nix packaging.

Acceptance Criteria

• ./podcast-tui --version exit code is checked; non-zero fails the job
• The output is asserted to start with podcast-tui (or contain the version that was tagged) — guards against silent crashes that print nothing
• If a runner-environment limitation makes the binary genuinely unrunnable (e.g. an aarch64 binary on x86_64 hardware — should not happen given the matrix, but as a defensive note), the failure mode must be a clear, actionable error, not a silent pass
• Equivalent assertion added on the Windows side (currently ./podcast-tui.exe --version is already strict — confirm it stays strict)

Implementation Notes

Current:

- name: Test Linux binary
  if: matrix.os == 'Linux'
  run: |
    cd releases/v*/
    tar -xzf *${{ matrix.arch_suffix }}.tar.gz
    cd *${{ matrix.arch_suffix }}/
    chmod +x podcast-tui
    ./podcast-tui --version || true

Proposed:

- name: Test Linux binary
  if: matrix.os == 'Linux'
  run: |
    cd releases/v*/
    tar -xzf *${{ matrix.arch_suffix }}.tar.gz
    cd *${{ matrix.arch_suffix }}/
    chmod +x podcast-tui

    OUTPUT="$(./podcast-tui --version)"
    echo "Got: $OUTPUT"
    if [[ "$OUTPUT" != podcast-tui* ]]; then
      echo "::error::Binary did not produce expected --version output"
      exit 1
    fi

set -euo pipefail is already implicit on bash runners; the explicit exit ensures we fail loudly.

Why || true was likely there originally

Before the matrix conversion in PR #199, the test step was a single Linux runner running x86_64 binaries — no environment-mismatch concern. || true may have been pasted defensively. With the explicit matrix (x86_64 on ubuntu-latest, aarch64 on ubuntu-24.04-arm), the architecture always matches the runner, so there's no remaining reason to suppress failures.

Out of Scope

• Adding more substantive smoke tests (e.g. spawning the TUI and asserting it doesn't crash on first frame). That's a meatier effort tracked separately if/when desired.
• Touching the Windows test step (already strict).

Estimate

XS (~30 min). One file, one step, one test workflow run on a tag dispatch to validate.

References

• Copilot review on PR feat(nix): binary-fetch flake + HM/NixOS modules + aarch64-linux #199: feat(nix): binary-fetch flake + HM/NixOS modules + aarch64-linux #199 (comment)... (line 283 of release.yml)
• ADR-005 mentions the artifact tarball is the same one consumed by the binary-fetch flake — making a passing artifact test a hard prerequisite for the auto-bump PR not landing broken hashes