Add sunbeam check verb with service-level health probes

11 checks across 7 namespaces: gitea version+auth, postgres CNPG
readiness, valkey PONG, openbao sealed state, seaweedfs filer,
kratos health, hydra OIDC discovery, people HTTP (catches 502s),
people API, and livekit. Supports ns and ns/svc scoping.

- checks.py: new module with _http_get (no-redirect opener + mkcert SSL),
  kube_exec-based exec checks, and cmd_check dispatch
- kube.py: add kube_exec() and get_domain() (reads from cluster configmap)
- cli.py: add 'check [target]' verb
- 103 tests, all passing

sunbeam/tests/test_cli.py

@@ -31,6 +31,8 @@ class TestArgParsing(unittest.TestCase):
         p_build.add_argument("what", choices=["proxy"])
         sub.add_parser("mirror")
         sub.add_parser("bootstrap")
+        p_check = sub.add_parser("check")
+        p_check.add_argument("target", nargs="?", default=None)
         return parser.parse_args(argv)
 
     def test_up(self):
@@ -83,6 +85,21 @@ class TestArgParsing(unittest.TestCase):
         with self.assertRaises(SystemExit):
             self._parse(["get", "ory/kratos-abc", "-o", "toml"])
 
+    def test_check_no_target(self):
+        args = self._parse(["check"])
+        self.assertEqual(args.verb, "check")
+        self.assertIsNone(args.target)
+
+    def test_check_with_namespace(self):
+        args = self._parse(["check", "devtools"])
+        self.assertEqual(args.verb, "check")
+        self.assertEqual(args.target, "devtools")
+
+    def test_check_with_service(self):
+        args = self._parse(["check", "lasuite/people"])
+        self.assertEqual(args.verb, "check")
+        self.assertEqual(args.target, "lasuite/people")
+
     def test_no_args_verb_is_none(self):
         args = self._parse([])
         self.assertIsNone(args.verb)
@@ -189,3 +206,27 @@ class TestCliDispatch(unittest.TestCase):
                 except SystemExit:
                     pass
         mock_build.assert_called_once_with("proxy")
+
+    def test_check_no_target(self):
+        mock_check = MagicMock()
+        with patch.object(sys, "argv", ["sunbeam", "check"]):
+            with patch.dict("sys.modules", {"sunbeam.checks": MagicMock(cmd_check=mock_check)}):
+                import importlib, sunbeam.cli as cli_mod
+                importlib.reload(cli_mod)
+                try:
+                    cli_mod.main()
+                except SystemExit:
+                    pass
+        mock_check.assert_called_once_with(None)
+
+    def test_check_with_target(self):
+        mock_check = MagicMock()
+        with patch.object(sys, "argv", ["sunbeam", "check", "lasuite/people"]):
+            with patch.dict("sys.modules", {"sunbeam.checks": MagicMock(cmd_check=mock_check)}):
+                import importlib, sunbeam.cli as cli_mod
+                importlib.reload(cli_mod)
+                try:
+                    cli_mod.main()
+                except SystemExit:
+                    pass
+        mock_check.assert_called_once_with("lasuite/people")