Harden post-merge validation labs

[chrisbliss18]

Summary

• Tighten scale-resilience lab assertions after monitor shutdown while preserving bucket coverage and activity checks.
• Make scale-lab DB disruption windows configurable for longer lock/read-only/pause recovery validation.
• Add make api-cli-public-fixture-validate, an isolated WPCOM-disabled API validation stack that keeps target safety enabled via a public-looking Docker-internal fixture IP.
• Update API/getting-started/migration/project docs for target-safe fixture validation.

Validation

• bash -n scripts/api-cli-validate.sh scripts/api-cli-public-fixture-validate.sh scripts/scale-resilience-lab.sh
• git diff --check
• Host 6: full scale-resilience lab pass with default DB disruption windows
• Host 6: scale-resilience lab pass with JETMON_SCALE_LAB_DB_RUNTIME_LOCK_SEC=30, JETMON_SCALE_LAB_DB_READ_ONLY_SEC=30, JETMON_SCALE_LAB_DB_PAUSE_SEC=60
• Host 6: 1,200-site internal-only soak for 10 minutes, all samples fresh
• Host 6: scripts/api-cli-public-fixture-validate.sh run passed alert-contact Mailpit send-test, webhook HMAC delivery, and HTTP-500 event assertions
• Host 6: govulncheck ./... reported no vulnerabilities
• make rollout-docs-verify passed, including go test ./... and go vet ./...

Safety Notes

• No WPCOM calls were enabled during validation.
• Email validation used Docker-local Mailpit only.
• Target traffic stayed on host-local Docker networks.