fix(smoke): route the Chromium tier through ENGINE_SMOKES too

I claimed ENGINE_SMOKES was the single home for "which smokes are
engine-sensitive". It was not: npm run smoke still hard-coded the same
three, so a fourth entry would have reached the Firefox and on-demand runs
and silently skipped the DEFAULT Chromium run -- which is the one GitHub
CI executes. The exact drift the list was introduced to remove, left in
the one tier that matters most.

npm run smoke now ends in smoke:web:chromium, which goes through the
runner like the other two tiers.

Two things fall out of that:

- The Chromium tier passes its engine as a literal argument, so an
  ambient SMOKE_BROWSER can no longer redirect it. Without that,
  SMOKE_BROWSER=firefox npm run ci would have run Firefox twice and never
  exercised Chromium at all -- a gate silently testing something other
  than what it claims.

- run-engine-smokes.test.mjs now asserts that no tier names an individual
  smoke, that both gated tiers name their engine explicitly, and that the
  on-demand entry point is the one that follows the environment. This is
  the durable half: a tier running fewer smokes is invisible at runtime,
  because it still passes. Mutation-verified -- restoring the old hard-
  coded chain fails the test.

Docs updated to state the wider claim rather than the one that was true
of only two tiers.

Addresses the suppressed comment on Copilot review 5026921914 of #2133.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/run-engine-smokes.mjs

@@ -8,10 +8,13 @@
  * from Node does, on every platform — the same reason `install-smoke-browser`
  * exists rather than an inline shell expansion.
  *
- * It also gives the smoke list ONE home. It used to be an `&&` chain in
- * package.json alongside a second chain in the workflow; adding a fourth smoke
- * meant remembering both. Now `ENGINE_SMOKES` is the list, and both the
- * on-demand command and the pre-push gate run through it.
+ * It also gives the smoke list ONE home. `ENGINE_SMOKES` is that list, and
+ * EVERY tier reads it — the default Chromium run inside `npm run smoke`
+ * (`smoke:web:chromium`), the Firefox pass in the pre-push gate
+ * (`smoke:web:firefox`), and the on-demand `smoke:web:engine`. Getting that
+ * wrong is silent: a tier that enumerated the smokes itself would simply run
+ * fewer of them and still pass, so `run-engine-smokes.test.mjs` asserts that no
+ * tier names an individual smoke.
  *
  * Usage: `node scripts/run-engine-smokes.mjs [engine]`. With no argument the
  * engine comes from `SMOKE_BROWSER` (default `chromium`).