Fix deploy smoke path handling and public invoker access

[gepser]

Summary

• fix scripts/smoke.sh default-path behavior so PROGRESS_PATH="" stays empty (for direct Cloud Functions URLs)
• deploy Cloud Functions Gen2 with allow_unauthenticated: true
• keep smoke checks using deploy output URL without duplicating /progress

Why

The deploy job was failing for two reasons:

1. smoke URL could become /progress/progress/:id
2. after switching to Gen2, endpoint required auth and smoke got 403

Validation

• ✅ mise exec -- make check
• ✅ local smoke script tested with both forms:
  • BASE_URL=http://localhost:8080 (default path)
  • BASE_URL=http://localhost:8080/progress PROGRESS_PATH=""

Notes

• This keeps the endpoint public like the existing markdown badge usage expects.
• After merge, rerun the Deploy workflow on master.