fix(playbooks): 3.1.0 herald deploy; the marker check takes a LIST now

Deploys althing-core 3.1.0 to nh3-extdev and restarts the herald.
Verified by content on both boxes: POST_OFFICE_HINT 0 -> 4 in
post_office_herald.py and resolve_post_office 0 -> 3 in dev_launch.py,
dist-info 3.0.3 -> 3.1.0.

The check took one file:marker pair. 3.1.0 changed two files, so a
single pair would have asserted half a release and passed -- the same
half-passing-silently shape as the version-string check it replaced two
releases ago, one level up. It now takes a space-separated list, reports
each pair individually, and fails if any is missing. Every release's
markers so far are recorded above the variable so the next bump is a
lookup rather than an archaeology exercise.

Also verified the behaviour the release exists for rather than just its
markers. The herald writes its address to $ALTHING_ROOT/post-office and
dev_launch.resolve_post_office reads it when the variable is unset:

  env unset          -> http://10.100.50.40:8390
  env set            -> the env value, which wins
  env set to blank   -> the file, because blank counts as unset

My first attempt tested this through postbox, which still requires the
variable and reported "no post office address is configured" -- correct
behaviour that looked like a failed deploy. dev-launch is the reader,
not postbox.

playbooks/nh3-extdev-althing-v3.yaml

@@ -19,21 +19,26 @@
 # Rerunnable: a second run shows the install and unit steps skipped.
 
 vars:
-  wheel_src: /home/lkraven/development/althing/dist/althing_core-3.0.3-py3-none-any.whl
-  wheel_dest: /tmp/althing_core-3.0.3-py3-none-any.whl
+  wheel_src: /home/lkraven/development/althing/dist/althing_core-3.1.0-py3-none-any.whl
+  wheel_dest: /tmp/althing_core-3.1.0-py3-none-any.whl
   uv: /home/infra-ops/.local/bin/uv
   tool_dir: /opt/uv-tools
   bin_dir: /usr/local/bin
   # ⚠ Moved off nh3-dev 2026-08-28. A stale value here does not fail loudly at
   # install time — it fails in the VERIFY, which then reads as a broken deploy.
   post_office: http://10.100.50.40:8390
-  marker: PANE_SETTLE_S
-  marker_file: post_office_herald.py
+  # ⚠ A release can change more than one file — 3.1.0 changed two. One pair is not
+  # enough, and a check that asserts only half a release is a check that half-passes
+  # silently. Space-separated `file:marker` pairs; bump BOTH per release.
+  #   3.0.1  zellij.py:_PANE_ID  session_source.py:_live_pid    (pane routes)
+  #   3.0.3  post_office_herald.py:PANE_SETTLE_S               (write/submit race)
+  #   3.1.0  post_office_herald.py:POST_OFFICE_HINT  dev_launch.py:resolve_post_office
+  markers: "post_office_herald.py:POST_OFFICE_HINT dev_launch.py:resolve_post_office"
 
 steps:
   - name: Stage the v3.0.0 wheel
     upload:
-      src: /home/lkraven/development/althing/dist/althing_core-3.0.3-py3-none-any.whl
+      src: /home/lkraven/development/althing/dist/althing_core-3.1.0-py3-none-any.whl
       dest: "{{ wheel_dest }}"
       mode: "0644"
 
@@ -109,7 +114,7 @@ verify:
     shell: ALTHING_POST_OFFICE={{ post_office }} {{ bin_dir }}/postbox --handle operator handles | wc -l | awk '{ if ($1 >= 70) exit 0; else exit 1 }'
     changed_when: "false"
 
-  - name: This release's marker is present BY CONTENT, not by version string
+  - name: This release's markers are ALL present BY CONTENT, not by version string
     # forseti's own checks. A dist-info directory records what was INSTALLED, not
     # what the files CONTAIN — verify the code, not the label. Bump `marker` and
     # `marker_file` with each release rather than trusting the version bumped.
@@ -117,5 +122,11 @@ verify:
     #   3.0.3  PANE_SETTLE_S in post_office_herald.py  (the write/submit race)
     shell: |
       SP={{ tool_dir }}/althing-core/lib/python3.13/site-packages/althing
-      grep -q '{{ marker }}' "$SP/{{ marker_file }}"
+      rc=0
+      for pair in {{ markers }}; do
+        f="${pair%%:*}"; m="${pair##*:}"
+        if grep -q "$m" "$SP/$f"; then echo "  ok   $f : $m"
+        else echo "  MISS $f : $m"; rc=1; fi
+      done
+      exit $rc
     changed_when: "false"