fix: require live smoke opt-in

[tensornull]

Summary

• require LIVE_SMOKE_ENABLED == 'true' for both scheduled and manually dispatched monitoring live smoke
• harden the workflow semantic checker against inline, folded-line, and decoy-job bypasses
• add regression coverage and align the live-smoke reviewer comment and release documentation

Root cause

The monitoring job treated workflow_dispatch as an alternative to the repository-variable opt-in. A manual dispatch therefore bypassed the live credential and cost gate whenever the default-branch guard passed.

Validation

• uv sync --locked
• uv lock --check
• Ruff lint and format checks
• Pyright: 0 errors
• Pytest non-live suite: 116 passed, 1 deselected
• Version, changelog, Public Preview content, secret, and workflow semantic gates
• Checksum-pinned actionlint 1.7.12
• Clean wheel and sdist build, Twine and artifact checks
• Independent clean-install smokes for wheel and sdist
• Copied standalone repository verification, including its full nested gate

No CometAPI request or live workflow was run.