[DimitryZH]

Summary

Add a dispatch-only hosted workflow for existing bounded Compose smoke validation, with candidate-bound evidence and scoped best-effort recovery.

Changes

• Pin read-only checkout/install/runtime inputs to the selected workflow commit.
• Validate tracked candidate paths, supported profile, strict boolean and pinned inventory objects; verify installed code/resources.
• Retain primary exit codes, upload only sanitized report JSON for seven days and escape summary values.
• Persist exact project identity before mutations for final cleanup; leave existing PR checks unchanged.

Validation

Offline tests, clean-wheel checks and targeted helper regressions passed. Symlink creation was unavailable locally; the full suite also passed on hosted Linux runners. Actionlint v1.7.12 passed. Selected-commit installed-package/input preflight passed without Docker. Self-review and git diff whitespace checks passed. PR CI passed on Python 3.11/3.13 (100 test methods and installed-wheel checks); Release check returned no_candidate_changes. Logs inspected.

Limits and pending acceptance

No real workflow_dispatch has occurred: the new workflow must first exist on the default branch. Owner review/merge and the documented post-merge baseline dispatch are required to verify 12 services, semantic flow, cleanup, artifact/summary and retained 12 legacy failures. Hosted live acceptance remains pending. Cancellation recovery is best effort and has not been verified live. No release approval, protection changes or milestone closure.

Related to #15

[DimitryZH]

Reviewed. Input validation, commit binding, sanitized evidence and scoped fallback cleanup are consistent with the task. CI passed. Ready to merge for workflow registration; hosted acceptance remains pending.