ORCH-058: --build-staging runs staging_check.py --mode stub vs fresh 8501 (AC-4)

Per ADR-001 step 3 / AC-4: after the freshly rebuilt staging container is
healthy, run staging_check.py --mode stub against the fresh 8501 stand BEFORE
reporting success, so the EXACT artefact BUILD-ONCE retagged to prod is the one
validated on staging. Fail-closed: staging_check rc!=0 -> exit 1 (not promoted).

- Invoked inside the container (docker exec $TARGET_SERVICE) per the canonical
  signature in scripts/staging_check.py header, --base-url http://localhost:$TARGET_PORT.
- Targets ONLY 8501 (staging), never 8500 (prod) - AC-9.
- --mode stub: fast, deterministic, no LLM spend (ADR).
- Static regression test test_tc07_build_staging_runs_staging_check_stub_after_health:
  asserts staging_check.py + --mode stub present, runs after health, before exit 0,
  fail-closed, and never hard-codes prod 8500.

scripts/orchestrator-deploy-hook.sh

@@ -175,8 +175,21 @@ if [[ "${1:-}" == "--build-staging" ]]; then
     fi
     log "BUILD-STAGING: running health-check on port $TARGET_PORT (10x6s)"
     if health_check 10 6 "build-staging-health"; then
-        log "BUILD-STAGING: $TARGET_SERVICE healthy on the fresh image (exit 0)"
-        exit 0
+        log "BUILD-STAGING: $TARGET_SERVICE healthy on the fresh image"
+        # AC-4 / ADR-001 step 3: validate the EXACT fresh artefact that will be
+        # BUILD-ONCE retagged to prod by running staging_check.py against the
+        # freshly recreated STAGING stand (8501, never prod 8500 - AC-9).
+        # --mode stub: fast, deterministic, no LLM spend (ADR). Run INSIDE the
+        # container so B6 reads the running instance own env (.env.staging).
+        log "BUILD-STAGING: running staging_check.py --mode stub against fresh 8501 (port $TARGET_PORT)"
+        if docker exec "$TARGET_SERVICE" \\
+            python3 /repos/orchestrator/scripts/staging_check.py \\
+            --base-url "http://localhost:$TARGET_PORT" --mode stub >> "$LOG" 2>&1; then
+            log "BUILD-STAGING: staging_check --mode stub PASS on fresh image (exit 0)"
+            exit 0
+        fi
+        log "BUILD-STAGING: staging_check --mode stub FAILED on fresh image - not promoting (exit 1)"
+        exit 1
     fi
     log "BUILD-STAGING: health FAILED after rebuild (exit 1)"
     exit 1