Release Smoke intermittently 404s fetching alchemy from pkg.ing

[deanjstone]

Problem

The `Release Smoke` job (`scripts/release-smoke.ts`, runs as part of the regular per-PR `Check` workflow) intermittently fails with:

```
[ERR_PNPM_FETCH_404] GET https://pkg.ing/alchemy/078ff00: Not Found - 404
Error: Command failed: vp install --lockfile-only --ignore-scripts

Root cause: \`infra/relay\`'s dependency on \`alchemy\` is pinned to a specific reference (\`078ff00\`, looks like a truncated commit SHA) fetched through a private registry proxy at \`pkg.ing\`. That specific pinned reference is either missing/expired on the proxy, or the proxy itself is flaky.

## Evidence

Not caused by any specific PR's code changes — confirmed on:
- PR #16's post-merge \`CI\` run on \`main\` (failed)
- PR #13's post-merge \`CI\` run on \`main\` (failed)
- PR #17's post-merge \`CI\` run on \`main\` (passed) — confirms it's intermittent, not a permanent block
- PR #18 (2026-08-09): failed twice in a row on both the initial run and a manual rerun, despite PR #18's diff only touching two workflow trigger blocks unrelated to \`infra/relay\`

## Suggested fix

One of:
- Pin \`alchemy\` to a stable published version instead of a commit-ish reference, if pkg.ing's commit-pinning is unreliable
- Vendor/cache the specific \`alchemy\` build \`infra/relay\` needs
- If this fork has no intention of ever deploying its own T3 Connect relay (see #15/#18's resolution — this fork builds local installers, not hosted infra), consider whether \`release-smoke.ts\` needs to install \`infra/relay\`'s dependencies at all for a smoke test scoped to the desktop/CLI release path, or whether that check should be scoped out for this fork the same way #18 disabled the relay deploy/release-cron workflows

## Scope

Found while investigating PR #18 (chore: disable auto-triggered Release/relay-deploy workflows) — that PR's scope was narrowly the always-failing scheduled/push-triggered workflows; this is a separate, intermittent issue in the always-on per-PR \`Check\` workflow, tracked here instead of expanding #18's scope.

[deanjstone]

Resolution

Closing as completed — the commit-ish pin is gone.

• infra/relay/package.json on fork main pins "alchemy": "2.0.0-beta.65"; pnpm-lock.yaml resolves alchemy@2.0.0-beta.65 and contains 0 pkg.ing references. It came in with upstream's "Upgrade Effect and Alchemy betas" (108e017), merged to this fork via PR chore: sync fork with upstream main (1295 commits) #20 (2026-09-05).
• Last ERR_PNPM_FETCH_404 was CI run 31337509234 (2026-08-09).
• Since 2026-09-01: 10 green CI runs. The three September failures (33952094839 onward) contain no pkg.ing/404 lines; they're Test-step and apt failures.

Caveat: no CI has run since 2026-09-06, so the post-fix sample is small. Reopen if the 404 recurs. Found in the 2026-10-01 issue-sequencing pass.