Ship the smithy-verify workflow the seed's release templates call
Follow-up to the review on #14. Every release template calls $/.github/workflows/smithy-verify.yml (before #14, ./.github/workflows/smithy-verify.yml), but the seed never shipped that workflow, so a freshly seeded SDK's release workflow failed validation until someone wrote one; hey-sdk, basecamp-sdk and fizzy-sdk each did, differently.
The seed now carries it: a pinned checkout and the basecamp/sdk/actions/smithy-verify@main step the test template ran inline, behind workflow_call, and test.yml.tmpl calls it too, so a new SDK has one definition of the check.
Verification, stated plainly. I rendered the templates with placeholder values and ran actionlint 1.7.12 and zizmor 1.30.0 over the result. actionlint reports only its known rejection of the $/ form, which a seeded repo carries the config for. zizmor reports 95 findings on this branch against 97 on main: this PR removes one unpinned-uses (the actions/checkout@v4 it replaces) and one artipacked, and adds nothing. The remaining findings are pre-existing in the seed templates: 44 unpinned-uses (high), 7 cache-poisoning (high), 9 excessive-permissions, 21 artipacked, 7 template-injection, plus the 5 self-repository that #14 rewrites. A freshly seeded SDK would fail its first audit on those; that is a separate PR, not this one.
Stacks on #14 (same $/ form); independent in content.