ci: a nightly create flow boots a scaffolded app, here instead of in the template

[flipvh]

Moves the nightly create-flow check out of cellajs/cella and into this repo. Pairs with cellajs/cella#1321 — merge this one first, so there is no night without the check.

Why it could not stay in the template

cellajs/cella is a template. create-cella copies .github/workflows/ into every scaffolded app and strips only the two infra/Pulumi.*.yaml files (TO_REMOVE), so every new app inherited create-flow.yml.

A scaffolded app is a fresh repo, not a GitHub fork, so GitHub does not disable its schedules. The cron fired nightly in raak, projectcampus and any other app, three legs of up to 40 minutes each — and failed there:

• the verify step greps for slug: 'my-app' and asserts the Cella-Base trailer against cellajs/cella tags;
• the heads leg scaffolded from $GITHUB_WORKSPACE, whose shared/config/config.template.ts the create had already consumed and deleted.

GitHub mails a failed scheduled run to the repo's last committer, so every app owner got the mail. pnpm cella sync also kept the file current in forks, since .github/ is synced.

Why here

The scaffolder is what the check tests, and this repo already owns that ladder: tests/e2e.test.ts scaffolds from the live template and reads the result, tests/release-smoke.test.ts scaffolds through the packed bin at publish time. This is the rung above them — the first that installs, migrates, boots and clicks. Nothing leaks out of this repo, and the workflow needs no secrets (just github.token for the release lookup).

What changed against the version in the template

• One shallow cella clone, two jobs. It is the smoke driver's source for every leg, and the template the heads leg scaffolds from. The driver stays in cella (cella/skills/verify/smoke-driver.mjs) and runs from the clone, never from the created app, because the published leg's app is built at a release that may not carry it yet.
• The heads leg scaffolds with this checkout instead of a clone of this repo's main, so a PR here exercises its own code.
• A cella-ref dispatch input replaces "dispatch the workflow on a cella branch": it picks the branch or tag the heads leg scaffolds from (and the driver for every leg).

Everything else is unchanged: three legs (published, published-main, heads), one step per README line, the step-outcome summary table, and the artifact with the stack log, screenshots and evidence.json. pnpm check, pnpm test and pnpm build on the created app are still deliberately out.

Checks

• actionlint clean (rhysd/actionlint:latest).
• The pull_request paths filter on this file means this PR runs all three legs, which is how the workflow gets tried before it exists on main.
• Expect published to stay red: npm serves @cellajs/create-cella 0.3.7 while main is 0.3.9, so that leg builds from a scaffolder predating cella#1310's fix. Pre-existing, and it clears on the next publish. published-main and heads are the legs to read.

🤖 Generated with Claude Code