* fix: smoke test uses semver tag (0.4.0) not git ref (v0.4.0)
github.ref_name = v0.4.0 but Docker metadata strips the v prefix,
so the image is tagged 0.4.0. Use steps.meta-alpine.outputs.version
which matches the actual image tag.
* ci: add actionlint to catch workflow syntax errors on PRs
Prevents broken release.yml from reaching main. Catches: syntax errors
in run scripts, invalid step output references, missing image names,
and other GitHub Actions misconfigurations.
