Add relay-health-check.sh and box relay-health action

Converts the cdp-relay-health-monitor from inline SSH (nested quoting
bugs) to a proper self-contained script on bl. Uses pinned ports from
netvm-names.sh as single source of truth.

New files/actions:
- bin/relay-health-check.sh: checks all four CDP relays, exits 0/1
- box-ctl.py relay-health: JSON wrapper for the Box CLI

Session: sidechat/chromebox-ops

bin/box-ctl.py

@@ -664,6 +664,20 @@ def act_fleet_status():
     fail("FLEET_ERROR", "failed to collect fleet data", {"stderr": r.stderr})
 
 
+def act_relay_health():
+    """Run relay-health-check.sh and return JSON results."""
+    audit("relay-health")
+    script = BIN / "relay-health-check.sh"
+    r = subprocess.run([str(script)], capture_output=True, text=True, timeout=60)
+    results = {}
+    for line in r.stdout.strip().split("\n"):
+        if ":" in line:
+            name, code = line.split(":", 1)
+            results[name.strip()] = code.strip()
+    all_healthy = r.returncode == 0
+    out(all_healthy, relays=results, healthy=all_healthy)
+
+
 def act_dm_log(limit=50):
     audit("dm-log", str(limit))
     cmd = [sys.executable, str(BIN / "super-cli.py"), "dm", "log", "--json", "-n", str(limit)]
@@ -1050,6 +1064,7 @@ USAGE = """usage: box-ctl.py <action> [args]
 
 fleet:
   fleet-status
+  relay-health
 
 timer actions:
   timer-list
@@ -1276,6 +1291,8 @@ def main(argv):
             fail("BAD_NAME", "usage: policy [check <agent>|show]")
     elif action == "fleet-status":
         act_fleet_status()
+    elif action == "relay-health":
+        act_relay_health()
     elif action == "dm-log":
         limit = 50
         if rest: