smoke: workspace export scenario + smoke-fresh target + fix the export bug it caught

The export round-trip (`vm create` → `workspace prepare` → guest edit →
`workspace export`) exposed a reproducible failure on Debian bookworm
guests: `git read-tree HEAD --index-output=/tmp/...` returns exit 128
"unable to write new index file" when the target lives on tmpfs while
`.git` is on the workspace overlay. Move the temp index into
`$(git rev-parse --git-dir)` so it shares a filesystem with `.git/index`
and the lockfile + rename + hardlink dance git does internally works.

Alongside:
- new workspace-export smoke scenario that would have caught this at
  the boundary between daemon and guest git
- `make smoke-fresh` = `smoke-clean && smoke` for release-time runs
  that want first-install paths (migrations, image pull) stamped into
  the coverage report

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -33,7 +33,7 @@ GO_LDFLAGS := -X banger/internal/buildinfo.Version=$(VERSION) -X banger/internal
 
 .DEFAULT_GOAL := help
 
-.PHONY: help build banger bangerd test fmt tidy clean install uninstall lint lint-go lint-shell coverage coverage-html coverage-total smoke smoke-build smoke-coverage-html smoke-clean
+.PHONY: help build banger bangerd test fmt tidy clean install uninstall lint lint-go lint-shell coverage coverage-html coverage-total smoke smoke-build smoke-coverage-html smoke-clean smoke-fresh
 
 help:
 	@printf '%s\n' \
@@ -50,6 +50,7 @@ help:
 	  '  make tidy            Run go mod tidy' \
 	  '  make clean           Remove built Go binaries and coverage artefacts' \
 	  '  make smoke           Build instrumented binaries, run scripts/smoke.sh, report coverage (needs KVM + sudo)' \
+	  '  make smoke-fresh     smoke-clean + smoke — forces first-install paths (migrations, image pull) into the coverage stamp' \
 	  '  make smoke-coverage-html  HTML coverage report from the last smoke run' \
 	  '  make smoke-clean     Remove the smoke build tree'
 
@@ -147,6 +148,15 @@ smoke-coverage-html: smoke
 smoke-clean:
 	rm -rf "$(SMOKE_DIR)"
 
+# smoke-fresh wipes everything under $(SMOKE_DIR) (instrumented
+# binaries, coverage pods, persisted XDG state) and runs a full
+# smoke from scratch. Useful before a release tag: the regular
+# `make smoke` reuses the XDG state across runs to skip the ~290MB
+# image pull, which is fast but leaves migrations and image-upsert
+# paths cold on every run after the first. smoke-fresh pays the
+# time cost to stamp those paths into the coverage report too.
+smoke-fresh: smoke-clean smoke
+
 install: build
 	mkdir -p "$(DESTDIR)$(BINDIR)"
 	mkdir -p "$(DESTDIR)$(LIBDIR)/banger"