Catch async startup failures in CI smoke tests

Both --version smoke tests passed on Windows even though the binary
crashed for users: commander exits the process synchronously, before the
Parser.init promise has a chance to reject. Three changes to close the
gap:

- cli/scripts/smoke-binary.ts: portable script that spawns the binary,
  lets it run for 5s, kills it, and asserts the captured stdout/stderr
  doesn't contain earlyFatalHandler markers ("Fatal error during
  startup", "Internal error: tree-sitter.wasm not found", unhandled
  rejections, missing modules). Wired into the release-build smoke step
  for every platform and into the freebuff-e2e build smoke step.

- freebuff/e2e/tests/startup.e2e.test.ts: wait for "Pick a model to
  start" to render instead of just non-empty output. The model selector
  only appears once the binary survived module init (Parser.init
  included), the auth/session API call returned, and the React tree
  mounted, so a half-rendered crash splash no longer satisfies the
  assertion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>