feat(validate): post-deploy validation on every HA start [#778]

Missing/stale criticals after restart page with specifics instead of
waiting for humans; watchdog handles recovery; revert procedure
documented for repeat failures.

automations.yaml

@@ -627,3 +627,64 @@
           title: WATCHDOG — restarting core
           message: "Still stale after reload + 30 min: {{ hard_stale | join(', ') }}. Restarting HA core now."
       - action: homeassistant.restart
+- id: pfv_post_deploy_validation
+  alias: PFV post-deploy validation
+  description: >
+    Runs after EVERY HA start (deploy restarts included): after a settle
+    delay, verifies the critical sensor set actually materialized and is
+    fresh. Catches bad deploys — missing templates, broken packages,
+    wedged pollers — and pages with specifics instead of waiting for a
+    human to notice (#778, #777). The watchdog then handles recovery.
+  mode: single
+  max_exceeded: silent
+  triggers:
+  - trigger: event
+    event_type: homeassistant_start
+  actions:
+  - delay:
+      hours: 0
+      minutes: 3
+      seconds: 0
+  - variables:
+      required:
+      - [sensor.pfv_tsys1_rack_temperature, 20]
+      - [sensor.pfv_tsys9_cpu_temperature, 20]
+      - [sensor.tsys1_ups_status, 15]
+      - [sensor.tsys1_triplite_status, 15]
+      - [sensor.pfv_ups_runtime_minutes, 30]
+      - [sensor.pfv_tripp_lite_runtime_minutes, 30]
+      - [sensor.pfv_deploy_gitea_release_head, 30]
+      - [automation.pfv_watchdog_stale_entities, 0]
+  - variables:
+      bad_list: >-
+        {% set ns = namespace(bad=[]) %}
+        {% for pair in required %}
+          {% set s = states[pair[0]] %}
+          {% if s is none or s.state in ['unknown', 'unavailable', 'none'] %}
+            {% set ns.bad = ns.bad + [pair[0] ~ ' (missing)'] %}
+          {% elif pair[1] > 0 and s.last_updated is defined
+                and (now() - s.last_updated).total_seconds() > pair[1] * 60 %}
+            {% set ns.bad = ns.bad + [pair[0] ~ ' (stale)'] %}
+          {% endif %}
+        {% endfor %}
+        {{ ns.bad }}
+  - if:
+    - condition: template
+      value_template: "{{ bad_list | length > 0 }}"
+    then:
+    - action: notify.send_message
+      target:
+        entity_id:
+        - notify.ultix_sidecar_new
+        - notify.allthes_ipad
+      data:
+        title: POST-DEPLOY VALIDATION FAILED
+        url: /lovelace-pfv-thermal
+        message: >-
+          After restart, these criticals are missing/stale:
+          {{ bad_list | join(', ') }}. Watchdog will retry recovery;
+          if this repeats, revert the last release (git revert + push).
+    - action: persistent_notification.create
+      data:
+        title: POST-DEPLOY VALIDATION FAILED
+        message: "Missing/stale: {{ bad_list | join(', ') }}"