Run a container smoke test against the real seafile daemon

Startup, shutdown and secret handling were only ever checked by hand, and the
unit tests cannot check them: they stub seaf-cli, so nothing exercised the
daemon that actually ships. The GitHub runner is x86_64, which matches the
AppImage, so the image build job can run the real thing.

tests/smoke.sh starts and stops the real daemon, sends SIGTERM through docker
stop and asserts the container exits 0 within the grace period with the daemon
shut down, checks that a configuration error exits 2 naming the variable, that
a secret mounted under /run/secrets is read and stays out of the environment,
and that a default container gets exactly the documented defaults.

The pinned client version is exposed as SEAFILE_CLI_VERSION in the image,
since seaf-cli has no --version flag and there is no package manager entry
for an AppImage.

.github/workflows/docker-publish.yml

@@ -52,6 +52,11 @@ jobs:
           load: true
           tags: ${{ env.IMAGE }}:ci
 
+      # Exercises the real seaf-cli and seaf-daemon in the built image, which
+      # the unit tests cannot do. The runner is x86_64, matching the AppImage.
+      - name: Container smoke test
+        run: tests/smoke.sh ${{ env.IMAGE }}:ci
+
   push:
     needs: [unit-test, test]