Harden deploy verification for #346 (catch port black-hole + missing secrets)

[NyxSpecter4]

Addresses #346

After a cluster lifecycle, new deploys report success while host-ports are black-holed and MANIFEST secrets resolve to null. The root cause lives in monkd (closed-source); this PR hardens the plugin-side verification so the agent catches the failure instead of green-washing it.

What changed (agents/monk-deployer.md, Verification section)

• Added an explicit host-port reachability check: probe loopback AND public-IP for each host-port service; a LISTENING socket that answers nowhere is reported as a failed deploy, not success.
• Added a secret-injection assertion: for each MANIFEST SECRET present in the vault, assert the running workload var is non-null; report 'secret not injected' instead of proceeding as ready.
• Clarified that a green monk.project.deploy return is necessary but NOT sufficient proof of a working deploy.

Scope / honesty

This is a detection and hardening fix on the agent-facing skill. It does not patch monkd lifecycle port/secret state (that remains an upstream platform issue). But it directly enforces azygoss's expectation in #346: a deploy must never report success while its published ports are unreachable from every source and its MANIFEST secrets were silently skipped.

Verification of the change

• No infra CLIs used (per the skill's own constraint). The checks use the agent's HTTP client, same as reaching the monk-agent MCP.
• Skill text reviewed against the live main source; markdown structure preserved.

Happy to adjust wording or move the reference into skills/monk/references/ if maintainers prefer.