feat(ops): add production continuity verifier

[arcabotai]

Status: ready for maintainer merge decision. Exact head ab9f3c2e032a5b4aff37802cbd0a9bbe2f26b840 rejects errored, out-of-order, unterminated, and whitespace-only SSE completion and preserves canary source through DB rehydration. Exact-head remote gates, independent review, and GitHub CI pass.

Summary

Add a bounded production continuity verifier and authenticated synthetic-canary handling without polluting customer metrics.

• verifies health, exact expected version, public statistics shape, installer integrity, bounded diagnosis, and a real agent-v2 SSE completion exchange
• requires a fully framed ordered SSE lifecycle with one metadata event, no error event, useful text, and one matching final completion event
• aggregates assistant deltas and requires non-whitespace output before declaring the canary healthy
• rejects non-HTTPS remote targets, credentials, paths, queries, fragments, redirects, and unapproved origin changes; loopback HTTP remains available only for tests
• runs free prerequisites before any optional paid or mutating canary work
• makes metered modes explicit manual inputs; scheduled runs remain read-only and free
• authenticates canaries with timing-safe comparison and persists them as source='canary'
• fails closed if durable canary persistence cannot be confirmed
• excludes canary rows from every diagnosis-backed public total, outcome, version, service-manager, crash, and pattern counter while retaining them internally
• preserves internal canary source through post-restart DB rehydration so fallback statistics cannot count synthetic rows
• requires diagnosis canary responses to acknowledge durable canary classification

Validation

Exact candidate head: ab9f3c2e032a5b4aff37802cbd0a9bbe2f26b840

• Node suite: 444/444 passed
• focused continuity and canary-metric suite: 26/26 passed
• remediation proof and repair validation passed (50 scripts, 0 blockers)
• npm audit --omit=dev: 0 vulnerabilities
• source archive SHA-256: 15815365eb496dba4c3bbee642df2487665eea5c12f318b3eaec2dfcb7c84800
• disposable-host gate exited 0; cleanup and empty provider inventory were verified
• exact-head GitHub CI passed: https://github.com/arcabotai/clawfix/actions/runs/30725310337
• syntax, diff, exact-head, and clean-worktree gates passed
• read-only production verification passed against https://clawfix.dev at published version 0.11.2

Fresh independent exact-head static review: READY, no findings.

No paid canary ran. No production data or deployment was mutated. This PR does not merge, deploy, publish npm, create a release, or tag 0.12.0.