ci: resolve draft release assets via API in smoke-test

Fixes Kilo CLI install failing with curl exit 22 when the smoke-test
workflow runs as a pre-publish gate. The browser download URL
(github.com/.../releases/download/...) 404s on draft releases, so
look up the asset via the releases API and let the installer use the
API URL with Accept: application/octet-stream and bearer auth.

Also bumps smoke-test.yml permissions to contents: write so the job
token can see draft releases, and re-enables the smoke-test job in
publish.yml.

.github/workflows/publish.yml

@@ -261,7 +261,7 @@ jobs:
     needs:
       - version
       - build-cli
-    if: false # Disable the smoketest job until it works when called on draft releases
+    if: github.repository == 'Kilo-Org/kilocode'
     uses: ./.github/workflows/smoke-test.yml
     with:
       cli_version: ${{ needs.version.outputs.version }}
@@ -272,7 +272,7 @@ jobs:
       - version
       - build-cli
       - build-vscode
-      # - smoke-test # Disable the smoketest job until it works when called on draft releases
+      - smoke-test
       # - build-tauri
     runs-on: ubuntu-24.04
     steps:

.github/workflows/smoke-test.yml

@@ -35,7 +35,7 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: read
+  contents: write # needed to read draft release assets when called from publish.yml
 
 jobs:
   smoke-test:
@@ -77,18 +77,30 @@ jobs:
             exit 1
           fi
 
-      - name: Resolve CLI version
+      - name: Resolve CLI asset URL
         id: cli
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           VERSION="${{ inputs.cli_version }}"
-          if [[ -n "$VERSION" ]]; then
-            URL="https://github.com/Kilo-Org/kilocode/releases/download/v${VERSION}/kilo-linux-x64.tar.gz"
-            echo "cli_url=$URL" >> "$GITHUB_OUTPUT"
-            echo "::notice::Testing CLI v${VERSION} from release: $URL"
-          else
+          if [[ -z "$VERSION" ]]; then
             echo "cli_url=" >> "$GITHUB_OUTPUT"
             echo "::notice::Testing latest CLI from npm"
+            exit 0
           fi
+          # Resolve the release asset via the API so this works for draft
+          # releases too (browser /releases/download/... URLs 404 on drafts).
+          # The installer passes Accept: application/octet-stream + bearer
+          # auth, which is what the API asset endpoint expects.
+          URL=$(gh api --paginate "repos/${{ github.repository }}/releases" \
+            --jq ".[] | select(.tag_name == \"v${VERSION}\") | .assets[] | select(.name == \"kilo-linux-x64.tar.gz\") | .url" \
+            | head -n1)
+          if [[ -z "$URL" ]]; then
+            echo "::error::asset kilo-linux-x64.tar.gz not found for v${VERSION}"
+            exit 1
+          fi
+          echo "cli_url=$URL" >> "$GITHUB_OUTPUT"
+          echo "::notice::Testing CLI v${VERSION} via asset API: $URL"
 
       - name: Run smoke test — hello-world
         env: