Add repository connectivity checks to verify playbook

[kvelarde-itential]

Ported itential.deployer's pre-flight verification improvements to itential.iag5's existing verify system, plus fixed two iag5-specific issues found along the way.

Made verify.yml continue past a single component's failure instead of aborting the whole run.
Root cause: Ansible aborts the entire ansible-playbook run — not just the current play — the moment a play ends with 100% of its hosts failed, even for later, unrelated plays. playbooks/verify.yml runs servers/runners/clients as three separate plays, and verify-os.yml/verify-specs.yml hard-failed with no ignore_errors, so one bad server host could have prevented the runner and client plays from ever running.

• verify-os.yml — both asserts now ignore_errors + register (os_validation/arch_validation); the file now also initializes validation_errors.
• verify-specs.yml — final assert now ignore_errors + register: specs_check; its existing specs_validation_errors list merges into the shared validation_errors.
• verify-tls-files.yml — wrapped the entire 14+ check sequence in block/rescue instead of converting every individual assert (many checks are intentionally sequential — e.g. checking cert/key match is pointless if the cert file doesn't exist). A failure anywhere jumps to rescue, which captures the real error via ansible_failed_result.msg into validation_errors and sets tls_validation.
• New verify-results.yml — combines whichever checks ran into a non-fatal per-host verification_passed fact and a component_validation_errors dict, both accumulated (AND / combine()) rather than overwritten, since a host can be checked by more than one component.
• playbooks/verify.yml gained a 4th play, hosts: all, that prints per-component failures and does the one real (non-ignored) assert — since nothing runs after it, failing there is safe and is what gives the run a genuine non-zero exit code.

Added connectivity + proxy checks (new capability — iag5 had neither before).

• New verify-connectivity.yml and verify-proxy.yml (same design as deployer's).
• gateway_server_required_repositories is computed dynamically in gateway_server/tasks/verify.yml (not a static default) from the enabled feature flags (gateway_server_features_ansible_enabled, _python_enabled, _opentofu_enabled), so a host isn't failed against a repository it doesn't actually need — matches the README's existing "Required Public Repositories" table exactly.
• gateway_client_required_repositories (new default in gateway_client/defaults/main/install.yml) checks https://registry.aws.itential.com, since gateway_client_packages can itself be an https:// URL to that registry, not just a local artifact path.

Fixed hardware-spec selection for the all-in-one topology.
iag5_servers hosts were always checked against gateway_server_hw_specs (the lower minimums), even in a single-node all-in-one inventory where there's no separate iag5_runners group and the server is also doing runner work locally. gateway_server/tasks/verify.yml now detects this the same way certify-tls.yml already does ('iag5_runners' in groups and groups['iag5_runners'] | length > 0) and checks the server against gateway_runner_hw_specs instead when no dedicated runner group exists. The component name in reports becomes "Server (acting as Runner)" in that case, so it's clear which spec set applied.

Docs: docs/verify.md (new Connectivity/Proxy check-reference sections, new "Non-Fatal Design" section, updated "How node type is determined" with the topology table, updated architecture diagram/overview table), CLAUDE.md (verify_common and gateway_server sections rewritten), README.md (added a "run verify" pointer next to the existing repository table).

Note on the verify-tls-files.yml diff size: it looks much larger than the actual change because every existing task got re-indented one level (to nest inside the new block:) — git's line diff can't recognize a pure indentation shift as a non-change. Diffing with whitespace ignored shows the real change is just the block/rescue wrapper plus two new bookend tasks; every one of the original checks is byte-identical (module, args, register, when, delegate_to, become).

Verified throughout: ansible-lint/--syntax-check clean on every touched/new file (only pre-existing-style var-naming warnings), plus multiple synthetic Ansible playbook runs confirming the continue-past-failure behavior, the block/rescue mechanism, the connectivity checks, and both hardware-spec topology branches (all-in-one vs. distributed) behave as intended.