ci: isolate smoke-asset download and fix PR code-quality checkout

[Akilan-Sivakumar]

• Fixes fork-PR CI failure: Refusing to check out fork pull request code from a 'pull_request_target' workflow.
• code-quality: adds allow-unsafe-pr-checkout: true to opt in (this job only reads changed files - it never builds/runs PR code) and persist-credentials: false so the token isn't left on disk.
• Adds a prep-assets job that downloads the smoke tarballs with the asset token and republishes them as an internal smoke-assets artifact - it checks out no PR code, so the token can't be exfiltrated.
• smoke-linux and smoke-windows now consume that artifact instead of holding the token, keeping the secret out of every job that runs fork code.