Add just verify-deploy, which asks an environment whether its deploy worked

CLAUDE.md

@@ -31,11 +31,15 @@ FastAPI backend and React front-ends for the RETINA passive-radar network.
   accounts in anything committed here.
 - **Configuration lives in `backend/.env`**, which is gitignored. Add new keys to
   `backend/.env.example` so the list stays current.
-- **Verify a deploy from the environment's API.** Green tests do not cover the
-  compose/env/frontend seams, so confirm the change against the environment
-  itself before calling a deploy done: `aircraft_on_map` in
-  `/api/test/dashboard`, the node set in `/api/radar/analytics`, and
-  `/api/radar/data/aircraft.json` for the data path. `/api/test/*` reads answer
-  only an administrator or the radar key, which stays on the droplet: read them
-  there with the runbook's `tst`. Scripted requests need a browser User-Agent or
-  Cloudflare answers `403 1010`.
+- **Verify a deploy with `just verify-deploy <prod|staging|test>`.** Green tests
+  do not cover the compose/env/frontend seams, so ask the environment itself
+  before calling a deploy done. Run it before the deploy too, and compare the
+  real nodes the two runs list. For a front-end change add
+  `--expect-string <text the change adds>`, which the earlier run must not find.
+  Its verdict rests on public reads; it runs its keyed checks (RETINA_ENV, task
+  health) only when `VERIFY_DEPLOY_RADAR_KEY` holds the radar key, and reports
+  them skipped otherwise. `/api/test/*` reads answer only an administrator or
+  the radar key, which stays on the droplet: read them there with the
+  runbook's `tst`. Scripted requests need a browser User-Agent or Cloudflare
+  answers `403 1010`. `deploy/verify-deploy.py` says what it checks and what it
+  cannot see.

ONBOARDING.md

@@ -361,7 +361,8 @@ CI runs on every PR, on push to `main`, and on demand through
    they fail after it; the runbook's Environments section has the shape.
 
 So merging to `main` deploys to production automatically. Work on a feature
-branch, open a PR, get it green, then merge.
+branch, open a PR, get it green, then merge. Once the deploy has run,
+`just verify-deploy <env>` asks that environment whether it worked.
 
 ## Things that will bite you