verify-sitelisted

# Verify the live site Confirm the deployed site is healthy. Use the base URL in `$ARGUMENTS` if one was given, otherwise `https://crosbynews.com`. Run the checks below with `curl`, then report a compact PASS/FAIL table. For anything that FAILs, quote the actual status/header so it's actionable. Deploys land in ~10–40s, so if a change is missing, wait and re-run before calling it a failure. ## 1. Routes return 200 Each path should respond `200`: `/`, `/weather`, `/hourly`, `/radar`, `/alerts`, `/water`, `/tropics`, `/pollen`, `/air`, `/traffic`, `/news`, `/calendar`, `/emergency`, `/about`, `/developers`, `/privacy`, `/contact`, `/sitemap`, `/es` (Spanish spot-check), `/robots.txt`, `/sitemap.xml`, `/llms.txt`, `/api/weather`, `/api/health`, `/api/news`, `/api/calendar`, `/api/water`, `/api/tropics`, `/api/pollen`, `/api/air`, `/api/traffic`, `/alerts.xml`, `/news.xml`, `/badge.svg`, `/manifest.json`, `/icon.svg`, `/sw.js`, `/.well-known/api-catalog`, `/openapi.json`, `/.well-known/security.txt`, `/.well-known/mcp/server-card.json`, `/.well-known/agent-skills/index.json`. ```bash curl -s -o /dev/null -w "%{http_code} %{url_effective}\n" "$BASE/<path>" ``` ## 2. Security + negotiation headers on `/` `curl -sI "$BASE/"` and confirm each header is present: - `strict-transport-security` - `x-frame-options` - `content-security-policy` - `x-content-type-options: nosniff` - `referrer-policy` - `permissions-policy` - `vary: Accept` - `link:` (advertises the markdown alternate, s