ci: fix post-publish smoke test and refresh-baselines auth

[chadjw]

Two pre-existing workflow failures, both consistently breaking every merge to main since at least 2026-05-18 (six failed Post-Publish Smoke Test runs in a row, and the refresh-baselines job has failed on the last several main merges including #363 and #365). Neither was introduced by a recent PR — they're workflow bugs.

Summary

1. Post-Publish Smoke Test (.github/workflows/smoke-test.yml)

• Was importing every published package by bare specifier in a loop. @harness-engineering/dashboard publishes only ./server and ./package.json subpath exports — it's a runnable server with no library API and a side-effectful entrypoint — so the bare import fails with No "exports" main defined.
• Switched dashboard to probe via @harness-engineering/dashboard/package.json instead. Other packages keep the bare-specifier import. npm install still resolves dashboard's transitive deps, so incident fix(types): republish types so downstream dist matches published exports #332-style cross-package drift would still surface there.

2. refresh-baselines (.github/workflows/ci.yml)

• Had permissions: contents: write only. Branch protection blocks direct pushes to main, so the workflow falls back to gh pr create — which fails with Resource not accessible by integration because the token lacks pull-requests: write. Result: the merge run is marked failed even when the baseline diff was empty.
• Added pull-requests: write to the job's permissions. Comment in the workflow explains the contract.

Test plan

• YAML validity: python3 -c "import yaml; yaml.safe_load(...)" parses both files.
• JSON-with-import-attributes syntax (with: { type: 'json' }) verified to work on Node 22+ locally (the smoke runner is pinned to Node 22).
• On merge: confirm Post-Publish Smoke Test passes end-to-end.
• On merge: confirm refresh-baselines either commits cleanly or successfully opens a baseline-refresh PR.

Out of scope

• Dashboard's published shape (no . export) is intentional; this PR adapts the test, not the package.
• The pre-existing arch baseline regressions in packages/cli (handleEmitSkillProposal complexity, module-size, dependency-depth) are unrelated.