cutover-prep: execute end-to-end rehearsal in staging

Several validation criteria from [plans/cutover-prep.md](../blob/main/plans/cutover-prep.md) require a live staging cluster + bucket + Slack workspace to verify. They were left unchecked at merge of #53 because the cluster isn't stood up yet (tracked by #36).

Once the staging cluster is operational, run through and tick these:

- [ ] Dry-run script (`script:cutover-dry-run`) runs end-to-end against the staging cluster + bucket without errors
- [ ] 100 sample laddr URLs all resolve correctly via legacy-id redirects on the staging deployment
- [ ] SAML assertion for a test laddr user matches their pre-cutover NameID byte-for-byte
- [ ] Account-claim flow works for: email-match user, password-match user, dead-email user (staff-review path)
- [ ] Rollback procedure rehearsed at least once: bring up staging, simulate cutover, then "rollback" (DNS flip) and verify the legacy site still works
- [ ] Cutover runbook reviewed by at least one staff member who hasn't been deep in the code
- [ ] Post-cutover monitoring alarms verified by intentionally breaking `/api/health` in staging
- [ ] Snapshot CI workflow has actually run on schedule against the production data repo and produced a valid scrubbed branch
- [ ] Snapshot clones + boots a fresh dev API (`STORAGE_BACKEND=filesystem`, empty private storage)

Depends on: #36 (cluster stand-up). Blocks: the actual cutover event.