POST /_cms/verify/widget — CodeMySpec asks this app to send a message through its own widget, so a working install is proven without waiting for a visitor. Shared through client_utils.

Authenticated by the deploy key (Authorization: Bearer <DEPLOY_KEY>), because an unauthenticated caller could fill the project's inbox. Kept off /health: that is the proxy's liveness probe, and a CodeMySpec outage must not take this app out of rotation.

Answers 200 only once CodeMySpec has stored the message; 503 when the widget cannot reach it.