chore: add deploy-smoke script for /v1/servers + deprecation headers

[mgoldsborough]

After every deploy I'm running an ad-hoc curl + jq sequence to verify the new /v1/servers/... family is healthy. Should be a checked-in script.

Today

make smoke ENV=staging runs the SDK integration tests, which hit /v1/bundles/... (the deprecated read endpoints). Doesn't touch the new endpoints, doesn't verify the deprecation headers, doesn't exercise the npm-style ↔ reverse-DNS resolution.

What I want

scripts/smoke-deploy.sh (or a Makefile target like make smoke-endpoints ENV=...) that runs against $REGISTRY_URL and asserts:

1. GET /v1/health → 200 + status: healthy + servers_count > 0
2. GET /v1/servers/search?limit=3 → 200 + 3 entries + each has a reverse-DNS name
3. GET /v1/servers/%40nimblebraininc%2Fecho (npm-style URL-encoded) → 200 + name == ai.nimblebrain/echo (curated org map round-trip)
4. GET /v1/servers/ai.nimblebrain%2Fecho (reverse-DNS URL-encoded) → 200 + same record (resolveByName candidate-generation)
5. GET /v1/bundles/search?limit=1 → 200 + Deprecation header (RFC 8594 IMF-fixdate) + Link: rel="successor-version"
6. GET /v0.1/servers?limit=2 → 200 + same shape as /v1 (single handler mounted at both prefixes)
7. /v1/servers/{name} returns the expected _meta["dev.mpak/registry"] keys: npmName, downloads, published_at, publishMethod, provenance, certification, artifacts

Each check exits non-zero on failure with a clear message naming what was expected vs received. Bash + curl + jq, no test framework dep — fast, runnable from any laptop.

Wire-up

• Add as new Makefile target smoke-endpoints in deployments/mpak/ (keep the existing smoke target for SDK integration coverage)
• Default REGISTRY_URL from ENV (staging → https://registry.preview.mpak.dev, production → https://registry.mpak.dev)
• CI hook: optional follow-up to run against staging after every deploy-all target completes (post-deploy gate)

Why now

Just deployed #100 to staging then prod and ran this smoke from my shell history. Without it checked in, the next operator has to either re-derive the curl invocations or trust the SDK integration tests (which only cover the deprecated read paths). 30 lines of bash.