cutover-prep: execute end-to-end rehearsal in staging

[themightychris]

Several validation criteria from plans/cutover-prep.md require a live staging cluster + bucket + Slack workspace to verify. They were left unchecked at merge of #53 because the cluster isn't stood up yet (tracked by #36).

Once the staging cluster is operational, run through and tick these:

• Dry-run script (script:cutover-dry-run) runs end-to-end against the staging cluster + bucket without errors
• 100 sample laddr URLs all resolve correctly via legacy-id redirects on the staging deployment
• SAML assertion for a test laddr user matches their pre-cutover NameID byte-for-byte
• Account-claim flow works for: email-match user, password-match user, dead-email user (staff-review path)
• Rollback procedure rehearsed at least once: bring up staging, simulate cutover, then "rollback" (DNS flip) and verify the legacy site still works
• Cutover runbook reviewed by at least one staff member who hasn't been deep in the code
• Post-cutover monitoring alarms verified by intentionally breaking /api/health in staging
• Snapshot CI workflow has actually run on schedule against the production data repo and produced a valid scrubbed branch
• Snapshot clones + boots a fresh dev API (STORAGE_BACKEND=filesystem, empty private storage)

Depends on: #36 (cluster stand-up). Blocks: the actual cutover event.