Make every governed deployment verification example copy-paste strict

## Outcome

Every public convenience example for verifying a managed deployment package includes the externally recorded closure digest and structural operator-file checks, matching the generated runbook.

## Context

PR #598 makes transferred-package and lifecycle instructions strict. Two convenience examples in the single-node Compose guide remain intentionally shorter and are not on the critical update path, but copying them alone provides weaker assurance.

## Definition of Done

- [ ] Every managed-package verification example uses `--expected-closure-sha256`.
- [ ] Every operator-ready verification example uses `--check-operator-files`.
- [ ] Examples show where the externally recorded digest comes from without inventing a secret/config generator.
- [ ] Docs tests prevent weaker commands from reappearing outside explicitly labelled structural-only examples.

## Non-goals

- Semantic validation of operator file values in Registryctl.
- Certification of operator-owned Compose overrides.
- A general secret-management workflow.

Start with the single-node Compose guide and compare its managed-package and operator-ready verification examples with the generated runbook from PR #598. Trace how the externally recorded closure digest is presented, then inspect the docs tests and extend their coverage so weaker commands are rejected except in explicitly labelled structural-only examples.

Written by the indexing model from the issue text.