docs(ha-diag-agent): replace curl verify commands with docker exec

Port 8087 is no longer mapped to the host. Operator verify commands
that used curl http://localhost:8087/health now use docker exec with
Python's urllib (the image is python:3.11-slim, no curl binary).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/ha-diag-agent/DEPLOY.md

@@ -115,8 +115,8 @@ docker ps | grep ha-diag-agent
 # Last 50 log lines
 docker logs ha-diag-agent --tail 50
 
-# FastAPI health endpoint
-curl http://localhost:8087/health
+# FastAPI health endpoint (no host port mapping — probe via docker exec)
+docker exec ha-diag-agent python -c "import urllib.request; print(urllib.request.urlopen('http://localhost:8087/health', timeout=5).read().decode())"
 # Expect: {"status": "ok", "ws_connected": true, ...}
 
 # Events are being written

services/ha-diag-agent/README.md

@@ -23,7 +23,7 @@ WebSocketMonitor (persistent, long-running — Phase 4b)
      silence > 5min or on disconnect. Emits ha_websocket_recovered
      when the connection is restored after a dead alert.
 
-FastAPI (port 8087)
+FastAPI (port 8087, internal only — no host port mapping)
   GET  /health             → liveness probe (includes ws_connected field)
   POST /trigger/<check>    → run a named check on demand
 
@@ -97,7 +97,7 @@ scripts/deploy/deploy.sh --service ha-diag-agent
 
 # 3. Verify
 docker ps --filter name=ha-diag-agent
-curl http://localhost:8087/health
+docker exec ha-diag-agent python -c "import urllib.request; print(urllib.request.urlopen('http://localhost:8087/health', timeout=5).read().decode())"
 ```
 
 ### chelsty-infra note