Add sunbeam check verb with service-level health probes

11 checks across 7 namespaces: gitea version+auth, postgres CNPG
readiness, valkey PONG, openbao sealed state, seaweedfs filer,
kratos health, hydra OIDC discovery, people HTTP (catches 502s),
people API, and livekit. Supports ns and ns/svc scoping.

- checks.py: new module with _http_get (no-redirect opener + mkcert SSL),
  kube_exec-based exec checks, and cmd_check dispatch
- kube.py: add kube_exec() and get_domain() (reads from cluster configmap)
- cli.py: add 'check [target]' verb
- 103 tests, all passing

sunbeam/cli.py

@@ -53,6 +53,11 @@ def main() -> None:
     p_build.add_argument("what", choices=["proxy"],
                          help="What to build (proxy)")
 
+    # sunbeam check [ns[/name]]
+    p_check = sub.add_parser("check", help="Functional service health checks")
+    p_check.add_argument("target", nargs="?", default=None,
+                         help="namespace or namespace/name")
+
     # sunbeam mirror
     sub.add_parser("mirror", help="Mirror amd64-only La Suite images")
 
@@ -106,6 +111,10 @@ def main() -> None:
         from sunbeam.images import cmd_build
         cmd_build(args.what)
 
+    elif args.verb == "check":
+        from sunbeam.checks import cmd_check
+        cmd_check(args.target)
+
     elif args.verb == "mirror":
         from sunbeam.images import cmd_mirror
         cmd_mirror()