ci(release): fix two ecosystem-publish pipeline gaps found on the 0.0.83 train

1. Index bump never worked from the release runner: version-check.py
   defaults --workspace to GITHUB_WORKSPACE, which inside the RELEASE
   repo's runner is the release repo — not the freshly-cloned index
   ('error: …/pkgs not found'). Pass --workspace . explicitly.
2. ci-fresh-install's 'on: release published' hook has never fired:
   the release is created with GITHUB_TOKEN and GitHub suppresses
   workflow triggers from GITHUB_TOKEN-generated events. Dispatch it
   explicitly with a PAT after publishing (best-effort; the daily
   schedule remains the fallback).

Author: Sunrisepeak

.github/tools/bump_index.sh

@@ -38,7 +38,11 @@ git config user.name  "xlings-ci"
 git checkout -q -B "$BRANCH"
 
 info "version-check.py --apply --only $PROJ"
-python3 .github/scripts/version-check.py --apply --only "$PROJ" > "$WORK/report.json" || {
+# --workspace: version-check.py defaults its repo root to GITHUB_WORKSPACE,
+# which inside the RELEASE repo's runner is the release repo — not this
+# freshly-cloned index. Point it at the clone explicitly ("error: …/pkgs not
+# found" was this default kicking in; observed on the 0.0.83 release).
+python3 .github/scripts/version-check.py --workspace . --apply --only "$PROJ" > "$WORK/report.json" || {
   echo "[bump] version-check failed:" >&2; cat "$WORK/report.json" >&2 2>/dev/null || true; exit 1;
 }
 

.github/workflows/release.yml

@@ -737,3 +737,16 @@ jobs:
           chmod +x .github/tools/bump_index.sh
           bash .github/tools/bump_index.sh mcpp "${{ steps.version.outputs.version }}" \
             || echo "index bump reported issues (non-blocking)"
+
+      # ci-fresh-install declares `on: release published`, but the release is
+      # created with GITHUB_TOKEN and GitHub suppresses workflow triggers from
+      # GITHUB_TOKEN-generated events — so that hook has never fired (only the
+      # daily schedule ran it). Dispatch it explicitly with a PAT; best-effort
+      # (the schedule remains the fallback).
+      - name: Dispatch fresh-install verification
+        if: ${{ env.XIM_PKGINDEX_TOKEN != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.XIM_PKGINDEX_TOKEN }}
+        run: |
+          gh workflow run ci-fresh-install.yml -R "${{ github.repository }}" --ref main \
+            || echo "fresh-install dispatch failed (non-blocking; daily schedule covers it)"