fix: verify production VM smoke on Pages

[tifycloud]

Summary

• update the fail-closed VM v2 Pages smoke verifier to the exact current 39-key production contract
• require HTTPS, HTTP-to-HTTPS redirect, runtime/production evidence, RAW and imported-VMDK persistence, five runtime-tested variants, and SSH-disabled evidence
• validate redirect/auth combinations, canonical unique host ports, and exact result paths
• retain the original v1 contract and stable promotion flow
• replace brittle source-shape grep with exact runtime contract assertions

Verification

• ./tests/test_static.sh
• real RC.6 smoke report matches the exact 39-key contract
• Python compile, shellcheck, and git diff --check
• independent review: PASS (no P0/P1/P2)

Production symptom fixed

After PR #13 fixed the label contract, Pages correctly reached the next fail-closed gate and excluded RC.6 because it still expected the previous VM v2 smoke-report shape.