revenant verify

Run all checks; optional AWS RDS snapshot restore sandbox.

When recovery.engine: aws-rds is set: find latest snapshot → restore to temporary sandbox (e.g. db.t3.micro) → run checks → destroy sandbox.

revenant verify [flags]

Flags:
  -c, --config string              Config path (default: revenant.yaml)
      --plan string                Must match yaml plan: if set
  -o, --output string              JSON report (default: report.json)
      --markdown string            Markdown report (default: report.md)
      --keep-sandbox-on-failure    Keep AWS sandbox when checks fail (debug)