[runtime] clarify legacy verification and clean /healthz alias

[GsCommand]

Motivation

• Remove a misleading placeholder Python test so the repo does not advertise fake-rigor in verification coverage.
• Make it explicit that the checked-in runtime/src/receipt-verification.js is compatibility-only and not the production verification path.
• Remove reliance on Express internals for the /healthz alias while preserving identical behavior to /health.

Description

• Deleted the placeholder Python test at sdk/python-sdk/tests/test_verification.py to avoid giving a false impression of Python-side CI coverage.
• Annotated runtime/src/receipt-verification.js with a clear legacy/compatibility comment and marked verifyReceipt as deprecated for production flows to point engineers to @commandlayer/runtime-core.
• Renamed several tests that exercise the legacy verifier to begin with Legacy verification helper or Legacy receipt verification compatibility to reduce confusion about what is production.
• Rewrote the health handlers in server.mjs to add buildHealthPayload() and sendHealth() and wired both /health and /healthz to sendHealth() so /healthz no longer uses app._router internals.
• Updated README.md and docs/OPERATIONS.md language to reflect the legacy status of the verifier and absence of a repo-local Python verification test in the Node CI workflow.

Testing

• Ran npm run check for syntax verification and it completed successfully.
• Ran npm run test:unit (Node unit tests) and all unit tests passed.
• Ran npm test (unit tests + smoke) and the full test suite including the smoke script completed successfully.

---

Codex Task