feat(bootstrap): list hosted verification endpoints

[tang-vu]

Summary

• add verify-hosted-bootstrap.sh --list-endpoints
• print the exact twelve default aliases consumed by the live hosted-bootstrap verifier
• avoid curl, compare, and Git-ref verification in discovery mode
• reject extra list arguments and keep the verification path unchanged

Why this matters

Release automation must verify every public installer alias, but the canonical alias list previously existed only inside the executable verifier. Maintainers can now discover that external contract directly and feed it into deployment checks without duplicating URLs or making network requests.

Overlap check

Searched open and closed PRs for hosted bootstrap endpoints list and PRs referencing ods/scripts/verify-hosted-bootstrap.sh. Open PRs #3391/#2765 trim response media types; closed #1776 updates branding. None exposes the verifier's endpoint inventory. This PR does not change transport, metadata, body, syntax, or cache checks.

Test plan

• bash ods/tests/test-hosted-bootstrap-verifier.sh
• bash -n ods/scripts/verify-hosted-bootstrap.sh
• bash -n ods/tests/test-hosted-bootstrap-verifier.sh
• git diff --check -- ods/scripts/verify-hosted-bootstrap.sh ods/tests/test-hosted-bootstrap-verifier.sh

Tradeoffs and rollback

The list is newline-delimited for direct shell composition and remains sourced from the verifier's active defaults. Removing the optional discovery mode restores the old CLI; hosted endpoint behavior is unaffected.

Generated with Codex

Batch compatibility

• Independently mergeable; tested combined in order feat(mode): emit routing status as JSON #3657 → feat(bootstrap): list hosted verification endpoints #3666.
• Base: upstream/main@6ff9b4fc; synthetic integration head: e45e2647.
• All focused public-boundary suites, the canonical generated-config JSON scan (12 surfaces), make lint, and git diff --check upstream/main...HEAD passed.
• tests/test-installer-context-parity.sh still fails at Hermes template bounds each model turn; the identical failure was reproduced on the exact upstream base, so it is not introduced by this batch.
• No live Docker mutation, model activation, migration, hosted deployment, or hardware validation is claimed.