fix(TC-500): preflight sealed Node startup configuration

[samgbafa]

Why

The v1.17.1 Phala rollout accepted the new image at the control plane but the process exited before serving HTTP: the sealed production trust bundle still carried the legacy https://email.tinycloud.xyz emailOrigin while the TC-500 runtime correctly requires the exact generic OpenCredentials audience https://witness.credentials.org. The corrected sealed bundle restored v1.17.1 without changing the node DID.

Change

• Add tinycloud --validate-config, which invokes the same trust-bundle and database-TLS configuration resolver used by normal startup, but opens no key, dstack context, database connection, socket, or network connection.
• Preflight the immutable build digest with the production-shaped canonical database, PostgreSQL TLS, Dstack-key, and sealed trust-bundle inputs in a read-only, networkless, capability-dropped container.
• Bind compose, preflight, and Phala to ghcr.io/tinycloudlabs/tinycloud-node@sha256:... from the build-dstack output; verify OCI org.opencontainers.image.revision equals GITHUB_SHA before the CVM can be replaced.
• Add regressions for the legacy emailOrigin and for a policy-v3 PostgreSQL URL that omits sslmode=verify-full.
• Probe the Node-owned delivery route and require its exact unsigned-body 401; control routes retain 400/422, and missing/server-error responses still fail deployment.
• Extend the deployment-contract verifier to lock immutable-image, production-shaped preflight, ordering, isolation, and route-status invariants.

Evidence

• node scripts/check-deployment-policy-probes.mjs
• workflow YAML parse and git diff --check
• cargo fmt --all -- --check
• cargo test -p tinycloud-node --features dstack config::tests::v2_preflight_rejects_postgres_without_verify_full -- --exact
• cargo test -p tinycloud-node --features dstack config::tests::legacy_email_origin_is_startup_fatal -- --exact
• canonical TINYCLOUD_STORAGE__DATABASE parsing tests under --features dstack
• cargo clippy -p tinycloud-node --all-targets --features dstack -- -D warnings
• package suite: 354/355 passed; unrelated pre-existing quota::test::concurrent_stale_refresh_spawns_only_one_background_fetch flaked once under full parallel execution (0 != 1), then passed immediately in isolation; remaining 354 library tests passed with that one test skipped.

No production mutation is part of this PR.