feat(onboarding): add verify primitives (install/config/integration)

[ArkNill]

Summary

Second slice of Path B (LLM-driven onboarding). Where env-fingerprint (PR #19)
describes the state of the user's environment, verify asserts expectations
about that state — producing pass/fail/warn/skipped per check so an agent
(Claude Code / Codex / Gemini) can decide what to do next without scraping
human-friendly output.

New CLI surface

llm-relay verify install
llm-relay verify config [--port]
llm-relay verify integration --cli {claude-code,openai-codex,gemini-cli,all} [--live]
llm-relay verify all [--live]

Common options: --format {text,json}, --quiet, --no-remediation.
Exit code: 0 on pass/warn, 1 on fail.

Output schema (schema_version "1")

{
  \"schema_version\": \"1\",
  \"target\": \"install|config|integration|<cli-id>|all\",
  \"captured_at\": \"...\",
  \"overall\": \"pass|fail|warn\",
  \"summary\": {\"pass\": N, \"fail\": N, \"warn\": N, \"skipped\": N},
  \"checks\": [
    {\"id\", \"label\", \"status\", \"detail\", \"remediation\"?, \"data\"?}
  ]
}

Status semantics:

• pass — expectation met
• warn — met with caveat
• fail — not met; remediation should fix it
• skipped — not applicable (e.g. CLI not installed)

Overall priority: fail > warn > (pass | skipped). Skipped never escalates to fail.

Checks (24 total)

target	check ids
install (6)	python_version, package_importable, entry_point_relay, entry_point_mcp (warn-on-missing), proxy_extras (warn-on-missing), version_consistency
config (7)	db_dir_exists, db_initialized, db_writable, config_file (warn), knowledge_dir (warn), port_available (warn-on-busy), no_deprecated_env (warn-on-CCPULSE_/CC_RELAY_)
claude-code (4)	binary, settings_present, proxy_route, mcp_server
openai-codex (3)	binary, config_present, proxy_route (always skipped pending upstream support)
gemini-cli (3)	binary, config_dir_present, oauth_known_issue (warn referencing upstream #25425)

Design notes

• Pure-Python: reuses setup_init / orch.discovery / recover.doctor / detect.scanner helpers — no duplicated detection logic.
• run_check() wrapper: captures exceptions as fail-with-detail so a single broken probe doesn't crash a whole report.
• aggregate(): namespaces sub-report check ids as <sub-target>.<id> to avoid collisions in verify all / verify integration --cli all.
• --live is opt-in: requires a network call (/_health); pure verify remains offline-friendly.

Test coverage

47 new tests under tests/test_verify/:

• Schema contracts + status validation
• Overall-priority rules
• Exception capture via run_check
• Per-check pass/fail/warn/skipped wiring for all three CLIs
• verify all aggregation with id namespacing

Full suite: 593 pass (546 baseline + 47 new). Ruff clean.

Smoke output (text format)

$ llm-relay verify install --quiet
target:  install
overall: warn
summary: pass=5 fail=0 warn=1 skipped=0

[warn   ] entry_point_mcp: llm-relay-mcp binary not found (optional MCP extra)
          → pip install llm-relay[mcp] (only needed if exposing the MCP server)

What's next (separate PR)

Final Path B deliverable: docs/AGENT_SETUP.md — the onboarding playbook that sequences env-fingerprint + verify into an end-to-end setup flow an agent can follow.