fix(domains): verify Cloud certificates on the serving edge

[Hydralerne]

Summary

A Cloud provider can report SSL active while its edge serves the apex certificate for www. Openship then reports HTTPS ready even though browsers reject it. Certificate renewal also treated an expiry timestamp as success without requiring a verified certificate.

Verify the certificate actually served for the requested hostname, and feed that observation through the existing domain status and monitoring issues.

Changes

• Check provider ownership and the exact Page binding, then verify public TLS with SNI, hostname, trust-chain and validity checks. Reuse the outbound address guard with DNS pinning and a five-second deadline.
• Preserve certificate state when the observer cannot connect, keep accepted renewals pending, and record confirmed invalid certificates. Deployment and interactive paths share persistence and the renewal response contract.
• Add a bounded observation job: at most 25 eligible Cloud custom domains per run, three concurrent checks, persisted backoff and a project-lock recheck. Domain details reflect the actual job schedule.
• Prevent automatic provisioning retries from issuing more certificates for an edge mismatch, pending issuance or unavailable observation. Explicit renewal retains ownership checks and issuance locks.

Verification

• All 13 GitHub checks passed, including both API shards, database, SDK/CLI, real edge/Cloud deployment tests, docs, and type checks.
• Real TLS server regressions cover SNI, an apex-only certificate requested as www, trust, expiry and stalled handshakes; public-address rejection is covered alongside the existing SSRF/safe-fetch tests.
• Database and engine tests cover eligibility, pending/unknown outcomes, renewal results, deployment warnings, and independent apex/www handling.
• Read-only live probes passed in Node and Bun; Bun also rejected an intentionally mismatched public certificate.
• API, dashboard, platform and adapter type checks, structured error audit, SDK/CLI distribution build, and complete docs/reference checks passed.
• Deliberately disabling hostname verification makes the real apex-versus-www regression fail; the unmodified implementation passes.

The local full run hit setup/import timeouts in six API files under load. All 112 tests in those files passed separately with --maxWorkers=1 and unchanged timeouts. Focused TLS, renewal, database, and diagnostics regressions also passed.

The observation path sends no HTTP request and does not recreate routes or restart services. Provider edge binding faults still require a provider repair. See docs/cloud-https-health.md for job controls and behavior.

Related issue

None — fixes from the deployment reliability audit requested by the maintainer.