docs: add verification guide, close WP-0002

- docs/verification.md: explains spec/server-baseline.yaml, goss/baseline.yaml,
  make verify workflow, assertion mapping table, and how to add new checks
- docs/convergence.md: replace manual spot-check snippet with make verify reference
- workplans/RAIL-HO-WP-0002: mark completed (all tasks done, workstream closed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/convergence.md

@@ -26,19 +26,20 @@ This will:
 
 ## Verifying
 
-Once convergence completes, you can test:
+After convergence, run the automated test suite to assert the node matches the
+baseline spec:
 
 ```bash
-ssh admin@<server-ip>
+make verify
+```
 
-# Check sudo access without password
-sudo -n true && echo "✔ sudo OK"
+This runs Goss assertions against all hosts and exits non-zero on failure.
+TAP reports are written to `reports/`. See `docs/verification.md` for details.
 
-# Firewall status
-sudo ufw status
+For a quick human-readable summary without assertions:
 
-# Installed tools
-htop --version
+```bash
+make status
 ```
 
 ## Notes