Launch live integrity from repository module

[chasebryan]

Summary

• launch the public live-integrity checker as the repository module tools.live_integrity_check
• preserve the repository root on Python's import path so the existing from tools import site_dist boundary works in the documented Make target and scheduled workflow
• execute the real module CLI --help path in offline tests and pin the Make command in repository-maintenance coverage
• request Bottle's canonical / route for the manifest index.html artifact instead of treating Cloudflare's /index.html redirect as content
• require exact status/location plus no telemetry headers on Pages redirects without requiring impossible asset/HSTS headers on HTTP redirects
• accept only the stricter no-store override on Cloudflare-generated 404 responses

Failure boundary

The first post-deployment readback failed before issuing its network assertion plan because the file-style Python launch could not resolve the tools package. Bottle and Cloudflare Pages deployments completed, but no live-integrity success was claimed.

Validation

• make live-integrity-test — pass, including the real module CLI entrypoint
• make repository-maintenance-test — pass
• make -n live-integrity-check emits python3 -m tools.live_integrity_check ...
• bounded production readback proved exact site/Bottle bytes and exposed the corrected canonical-response assumptions; remaining failures are explicit account-level NEL, cache-TTL, www redirect, and retired-Pages gates
• diff check and source-only worktree checks pass; no ISO, APK, compiled release image, generated private build evidence, credential, identity, or plaintext Bottle content is tracked