Make every governed deployment verification example copy-paste strict

[jeremi]

Outcome

Every public convenience example for verifying a managed deployment package includes the externally recorded closure digest and structural operator-file checks, matching the generated runbook.

Context

PR #598 makes transferred-package and lifecycle instructions strict. Two convenience examples in the single-node Compose guide remain intentionally shorter and are not on the critical update path, but copying them alone provides weaker assurance.

Definition of Done

• Every managed-package verification example uses --expected-closure-sha256.
• Every operator-ready verification example uses --check-operator-files.
• Examples show where the externally recorded digest comes from without inventing a secret/config generator.
• Docs tests prevent weaker commands from reappearing outside explicitly labelled structural-only examples.

Non-goals

• Semantic validation of operator file values in Registryctl.
• Certification of operator-owned Compose overrides.
• A general secret-management workflow.