ci: PR smoke test for a11y-scan SPM plugin (end-to-end scan)

[Crash0v3rrid3]

What

Adds .github/workflows/spm-smoke-test.yml — a GitHub Actions workflow that smoke-tests the a11y-scan SwiftPM command plugin end-to-end on every PR.

On a macOS runner it:

1. cd tests/spm && swift build — compiles the a11y-scan command plugin (via the path dependency) and the sample sources. (The repo root is a plugin-only package with no buildable target, so it is not built directly.)
2. cd tests/spm && swift test with RUN_A11Y_SCAN=1 + credentials — this un-gates the repo's existing testA11yScanPluginRuns, which runs scripts/run-a11y-scan.sh --non-strict (a real scan: downloads the BrowserStack CLI, authenticates, scans the sample SwiftUI sources with intentional a11y issues) and asserts exit 0.

It reuses the harness the repo already ships (tests/spm/) rather than duplicating the swift package plugin … scan invocation, so there's a single source of truth for how the plugin is run.

Design notes

• Fork-safe. The scan needs BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY, and secrets are never exposed to fork PRs. The job is gated with github.event.pull_request.head.repo.fork == false (plus workflow_dispatch for manual runs). Fork PRs skip the job instead of failing.
• Degrades gracefully. If the secrets aren't configured yet, testA11yScanPluginRuns XCTSkips and the job still passes (build + unit test only) — so merging this doesn't turn the tree red before secrets are added.
• --non-strict is used by the underlying test, so planted a11y issues in the sample views don't fail the run — a clean exit means the whole download → auth → scan pipeline worked.
• actions/checkout is pinned by SHA (v4.2.2) to match Semgrep.yml / verify-selfupdate-checksums.yml (supply-chain hardening, DEVA11Y-476).

Verified locally (macOS, Swift 6.2)

• tests/spm swift build → Compiling plugin a11y-scan + sample sources, build complete.
• tests/spm swift test (no RUN_A11Y_SCAN) → testLibraryIdentity passes, testA11yScanPluginRuns skips, exit 0. Confirms the no-secrets path stays green.
• The full authenticated scan path was not run locally (no creds on this machine); it exercises on CI once the secrets are set.

⚠️ Required before this actually runs the scan

Add two repo secrets (Settings → Secrets and variables → Actions):

• BROWSERSTACK_USERNAME
• BROWSERSTACK_ACCESS_KEY

Until then the job passes but the e2e scan self-skips.

Notes / open questions

• Covers the SwiftPM harness (tests/spm/). The tests/xcode-app/ build-phase harness is not wired up here — happy to add an Xcode job in a follow-up if you want CI to cover that integration path too.
• No DEVA11Y ticket linked yet — branch is chore/spm-pr-smoke-test; rename/link as needed.

🤖 Generated with Claude Code