## Summary

Linux release smoke tests currently install packages on the runner or in
containers with writable workspace mounts. Run them through the shared
[release-smoke-test
action](https://github.com/astral-sh/github-actions/tree/3994daa59cb9d97f991f8196a17218a2641fce4b/release-smoke-test),
which mounts completed artifacts read-only.

Pin the test images and select the installed Rust toolchain as the
container default so pip can invoke Cargo from its temporary build
directories. Invoke pip through Python so cross-wheel tests use the
upgraded pip.

## Test plan

- [ ] Ensure the PR's Build binaries jobs run and succeed, including
sdist and wheel smoke tests using the pinned shared action on native and
emulated architectures.

Release archives already have `.sha256` files, but the custom binary
build jobs don't put those hashes in cargo-dist's manifest. The
generated shell installer therefore has no expected archive hashes to
check.

Add a job that imports the built archives' checksums into a local
manifest before cargo-dist generates the installers. Run the helper
through uv with a script lockfile, require a valid sidecar for every
downloaded executable archive, and require the job to succeed before
hosting the release.

## Summary

- Map ty's `redundant-condition` and `redundant-condition-strict` rules
to the corresponding mypy and Pyright diagnostics, with scope notes for
expressions used as values, comparisons, and unreachable code.
- Map `disjoint-cast` to basedpyright's `reportInvalidCast` and link the
new rules to their documentation.