fix: clean up example fragment markup and smoke inventory

[cssbruno]

Summary

• Move endpoint and flagship fragment markup out of Go string assembly into embedded html/template files.
• Add examples/smoke-sources.txt as the shared source of truth for broad example report checks.
• Keep the login dashboard public, document it as action/API/session plumbing, and point protected-page readers to examples/auth-guard.
• Tighten multipart action generation so form.Data handlers do not emit an unused values declaration.
• Align release workflow coverage with the current consolidated release workflow.
• Reduce PR CI to CI / PR title and a lean CI / Verify gate, with superseded CI runs cancelled automatically.

Issue Closure

Fixes #760
Fixes #761
Fixes #762
Fixes #763

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed. Covered by the lean Verify workflow step; no editor files changed locally.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.
• I considered security-sensitive surfaces such as auth, CSRF, redirects, request-time handlers, logs, diagnostics, embedded assets, editor commands, WASM, contracts, and realtime behavior.

Commands run locally:

• go test ./internal/appgen
• go test ./examples/endpoints/src/endpoints ./examples/flagship/src/app ./examples/login/src/features/auth
• go test ./internal/gowdkcmd -run TestReleaseTrustWorkflowCoverage
• go test ./internal/gowdkcmd
• go test ./...
• (cd examples/login && rm -rf .gowdk bin dist && go run ../../cmd/gowdk build && go test ./src/features/auth)
• (cd examples/login && rm -rf .gowdk bin dist && go run ../../cmd/gowdk build --target login && rm -rf .gowdk bin dist && make split-build)
• sh scripts/check-example-reports.sh
• go build ./cmd/gowdk
• scripts/test-go-modules.sh
• sh scripts/check-docs-style.sh
• sh scripts/check-docs-links.sh
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/ci.yml

Note: scripts/check-example-reports.sh still prints existing accessibility/button warnings, and scripts/check-docs-style.sh still prints existing long-paragraph warnings; both exited 0.

LLM Assistance

• LLM session summary: Codex implemented the example cleanup, diagnosed the failing PR checks, rebased onto current main, fixed stale release workflow coverage, restored the login example to direct gowdk build compatibility, and reduced PR CI to a lean title plus verify setup.
• Human-reviewed assumptions: The login example should teach action/API/session plumbing while protected pages remain documented through examples/auth-guard; routine PR checks should stay small and avoid expensive audit/fuzz/race/dead-code/generated-output matrix gates.
• Follow-up work: Update repository branch protection settings to require PR title and Verify instead of the previous individual CI job names.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c083f09cc9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Ensure direct login builds install the guard hook

When this page switches to the custom auth.required guard, the generated app requires GOWDKGuardRegistry; I checked the documented clean-tree command go run ../../cmd/gowdk build --target login in examples/login/README.md and it now fails with undefined: GOWDKGuardRegistry because only the Makefile copies apphooks/login_hooks.go.txt into .gowdk/.../gowdkapp. Either update the direct commands to create/copy the hook first or route users to make build/make split-build so the example remains reproducible from a clean checkout.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep split login builds compiling with SSR load data

With this new server {} dashboard, the split target now generates frontend SSR code that calls auth.LoadDashboard, but the generated frontend app does not import the auth package. I checked make split-build from a clean examples/login tree and it fails while compiling .gowdk/login-frontend/gowdkapp/app.go with undefined: auth, so the advertised split example cannot build until the split frontend gets the bound SSR load import or the dashboard is kept out of that target.

Useful? React with 👍 / 👎.