P2: Fleet verify-tokens on OCI / second machine

## Parent
https://github.com/OpenSIN-Code/SIN-Save-Token/issues/1

## Context
BEST-PRACTICES: plumbing 100% on primary Mac; OCI + other hosts unverified.

## Work
- Run `bin/install.sh --check` + `verify-tokens` on second host
- Fix path assumptions (absolute REPO_DIR in heal hook)
- Document failures

## Acceptance
At least one non-primary host green or known gap list.