Add backend CD entry point to api-smoke (deployed-SHA + min_passed guards)

[saqibmanan]

Summary

Wiring needed for DataSpaceBackend's new ECS deploy pipeline to call api-smoke as its post-deploy gate (mirrors the ParakhAI_test backend-smoke pattern). Additive — DataSpaceFrontend's existing call to this workflow is untouched.

• run-smoke.yml: added workflow_call.inputs for api_base_url, deployed_sha, min_passed on the api-smoke job. api_base_url maps to API_BASE_URL; deployed_sha maps to EXPECTED_DEPLOYED_SHA.
• New test_health_check_deployed_sha_matches in test_api_001_health.py: asserts /health/'s git_sha field matches EXPECTED_DEPLOYED_SHA when set (skips, not silently passes, when unset — e.g. ad-hoc runs with no specific commit to check). Accepts either 200 or 503 from /health/, since a deploy can be running the right code while still reporting a dependency as unhealthy — that's a separate concern from the existing test_health_check_returns_200.
• New min_passed guard step after the pytest run, parsing report.json.

Real bug found and fixed while wiring this up: api-smoke has never set API_BASE_URL anywhere — only HOME_URL_DEV/TEST_EMAIL_1/TEST_PASSWORD_1. api_base_url()'s fixture calls pytest.skip() when that var is unset, so every run of this job has been silently all-skipping since it was added — 0 failures, exit 0, green, regardless of whether the backend is actually reachable. The new min_passed guard (default 1) means a fully-skipped run now fails loudly instead of looking identical to a passing one, and DataSpaceBackend's caller will be the first to actually populate API_BASE_URL.

Test plan

• python -m py_compile clean on the modified test file
• actionlint clean on every line this PR touches (pre-existing SC2086 findings on the consumer-smoke/provider-smoke sanity-check steps are untouched, identical before/after)
• Confirmed via gh secret list that API_BASE_URL doesn't exist as a repo secret today, and traced api_base_url() -> pytest.skip() in tests/api/conftest.py to confirm the silent-skip mechanism
• Not run live against real infra yet — this lands as unreachable dead code for existing callers until DataSpaceBackend's pipeline (in progress, separate repo) actually calls it with real values