test: `test/smoke/run.mjs` has no tests of its own, unlike every other non-vitest runner here

[IgorShevchik]

Environment

main, after #483.

Description

The repository has two runners outside vitest. One is tested; the other is not.

runner	size	its own tests
.github/scripts/*.sh + *.py, via test/workflows/run.sh	small	pin-check.test.sh, lockfile-check.test.sh, watchdog.test.sh — 49 cases against stubbed gh / npm
test/smoke/run.mjs	~230 lines	none

The asymmetry was raised in review of #483 and is fair. run.mjs is not glue — it decides what counts as a failure, and several of its parts are ordinary functions with ordinary edge cases:

• resolveWithin(dir, url) — the directory-escape guard. The first version used startsWith(dir), which has no separator boundary and lets dist-anything through next to dist. It was fixed in review; nothing would catch it coming back.
• boot()'s problem collection — filters console messages to type() === 'error' and deduplicates through a Set, because Vue re-renders a broken component once per parent and one defect arrives as twenty identical lines. A change that dropped the dedup, or widened the filter to warning, would make the output unreadable or the check noisy, and nothing would say so.
• serveStatic's SPA fallback and MIME mapping — a wrong content type is the kind of thing that shows up as a mysterious browser console error attributed to the package under test.
• check() / the failure accounting — if this stopped counting, the run would report "smoke passed" while checks failed. That is the worst failure mode available to this file and it is completely unguarded.

The parts needing a real browser (boot's navigation) and a real build do not need covering. Everything above is pure or nearly so.

Suggested shape

Export the testable pieces and cover them the way test/workflows/ covers its scripts — small, fast, no browser:

• resolveWithin against traversal, sibling-prefix, encoded, and malformed-% inputs;
• the problem filter and dedup against a synthetic list of console messages;
• check()'s accounting: a failing check must make the run exit non-zero.

test/workflows/run.sh is the precedent for where they hang and how they report.

Priority

Low. This is a test of a test, and the smoke runner's own failures are loud rather than silent — with the single exception of check(), which could go quiet. Worth doing when someone next touches the file.