docs: add subdomain routing reference to AGENTS.md and verification script

- Add Subdomain Routing section to AGENTS.md with route placement, site context,
  API routing, and auth boundary guidance for future tasks
- Add scripts/verify-subdomains.sh for post-deployment verification of DNS, HTTPS,
  appcast regression, and SSL certificates

scripts/verify-subdomains.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Verify subdomain DNS propagation, SSL, and rewrite routing
+# Run after DNS CNAMEs are added and Vercel domains are configured.
+
+set -euo pipefail
+
+SUBDOMAINS=("nessa" "lineage" "gaze" "inputhalo")
+APICAST_ROUTES=("Gaze" "InputHalo")
+PASS=0
+FAIL=0
+
+check() {
+  local desc="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then
+    echo "✓ $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "✗ $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "=== DNS CNAME propagation ==="
+for sub in "${SUBDOMAINS[@]}"; do
+  cname=$(dig +short "$sub.freno.me" 2>/dev/null | grep -i "cname.vercel-dns.com" || true)
+  if [[ -n "$cname" ]]; then
+    check "$sub.freno.me CNAME → cname.vercel-dns.com" true
+  else
+    check "$sub.freno.me CNAME → cname.vercel-dns.com" false
+  fi
+done
+
+echo ""
+echo "=== HTTPS landing pages ==="
+for sub in "${SUBDOMAINS[@]}"; do
+  status=$(curl -sI -o /dev/null -w "%{http_code}" "https://${sub}.freno.me/" 2>/dev/null || echo "000")
+  if [[ "$status" == "200" ]]; then
+    check "https://${sub}.freno.me/ → 200" true
+  else
+    check "https://${sub}.freno.me/ → 200 (got ${status})" false
+  fi
+done
+
+echo ""
+echo "=== Appcast regression (freno.me) ==="
+for route in "${APICAST_ROUTES[@]}"; do
+  status=$(curl -sI -o /dev/null -w "%{http_code}" "https://freno.me/api/${route}/appcast.xml" 2>/dev/null || echo "000")
+  if [[ "$status" == "200" ]]; then
+    check "https://freno.me/api/${route}/appcast.xml → 200" true
+  else
+    check "https://freno.me/api/${route}/appcast.xml → 200 (got ${status})" false
+  fi
+done
+
+echo ""
+echo "=== Main site regression ==="
+status=$(curl -sI -o /dev/null -w "%{http_code}" "https://freno.me/" 2>/dev/null || echo "000")
+if [[ "$status" == "200" ]]; then
+  check "https://freno.me/ → 200" true
+else
+  check "https://freno.me/ → 200 (got ${status})" false
+fi
+
+echo ""
+echo "=== SSL certificates ==="
+for sub in "${SUBDOMAINS[@]}"; do
+  if echo | openssl s_client -connect "${sub}.freno.me:443" -servername "${sub}.freno.me" 2>/dev/null | \
+     openssl x509 -noout -checkend 0 2>/dev/null | grep -q "not expired"; then
+    check "${sub}.freno.me SSL valid" true
+  else
+    check "${sub}.freno.me SSL valid" false
+  fi
+done
+
+echo ""
+echo "=== Summary: ${PASS} passed, ${FAIL} failed ==="
+if [[ $FAIL -gt 0 ]]; then
+  exit 1
+fi