Restore full verify-all smoke gate (currently narrowed to 3 surfaces)

[coolsocket]

The CI in .github/workflows/repers-smoke.yml was temporarily narrowed (commit cc048af) from `verify-all --json` to three high-confidence surfaces:

1. `verify-install --json` ✅
2. `capabilities --action validate --json` ✅
3. `release-pack-verify --archive dist/repers-release-pack.zip --json` ✅

The reason: `verify-all` invokes the full `tests/smoke_repers.py` which currently fails on:

• `test_audit_warning_policy` (line 61): `assert strict.returncode == 1` — fails on Windows CI because the fresh checkout has no audit warnings, so strict mode exits 0 instead of 1.
• `test_bundle_status_json` (line 310): `assert status["doctor"]["ok"] is True` — fails on systems where `python` (not `python3`) isn't on PATH; the doctor probes `python --version` directly.
• Receiver / source-install / smoke-tests gates transitively fail because they call `bundle-status` or the full smoke.

Definition of done

• `test_audit_warning_policy` either seeds a warning before strict mode or weakens the assertion to accept rc∈{0,1}.
• `doctor.check_command("python", ...)` falls back to `python3` if `python` is unavailable.
• CI matrix re-enables `verify-all --json` as the gate after the above two fixes.
• Local smoke (`python tests/smoke_repers.py`) passes on Linux + macOS in addition to Windows.

Owner: maintainer.