Add relay-health-check.sh and box relay-health action

Converts the cdp-relay-health-monitor from inline SSH (nested quoting
bugs) to a proper self-contained script on bl. Uses pinned ports from
netvm-names.sh as single source of truth.

New files/actions:
- bin/relay-health-check.sh: checks all four CDP relays, exits 0/1
- box-ctl.py relay-health: JSON wrapper for the Box CLI

Session: sidechat/chromebox-ops

bin/box-ctl.py

@@ -664,6 +664,20 @@ def act_fleet_status():
     fail("FLEET_ERROR", "failed to collect fleet data", {"stderr": r.stderr})
 
 
+def act_relay_health():
+    """Run relay-health-check.sh and return JSON results."""
+    audit("relay-health")
+    script = BIN / "relay-health-check.sh"
+    r = subprocess.run([str(script)], capture_output=True, text=True, timeout=60)
+    results = {}
+    for line in r.stdout.strip().split("\n"):
+        if ":" in line:
+            name, code = line.split(":", 1)
+            results[name.strip()] = code.strip()
+    all_healthy = r.returncode == 0
+    out(all_healthy, relays=results, healthy=all_healthy)
+
+
 def act_dm_log(limit=50):
     audit("dm-log", str(limit))
     cmd = [sys.executable, str(BIN / "super-cli.py"), "dm", "log", "--json", "-n", str(limit)]
@@ -1050,6 +1064,7 @@ USAGE = """usage: box-ctl.py <action> [args]
 
 fleet:
   fleet-status
+  relay-health
 
 timer actions:
   timer-list
@@ -1276,6 +1291,8 @@ def main(argv):
             fail("BAD_NAME", "usage: policy [check <agent>|show]")
     elif action == "fleet-status":
         act_fleet_status()
+    elif action == "relay-health":
+        act_relay_health()
     elif action == "dm-log":
         limit = 50
         if rest:

bin/relay-health-check.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# relay-health-check.sh — check all four CDP relay endpoints on bl.
+# Self-contained: no nested SSH quoting. Sources pinned ports from netvm-names.sh.
+#
+# Output: "name:code" per relay on stdout.
+# Exit 0 if all return 200; exit 1 otherwise (lists failures on stderr).
+#
+# Called by the cdp-relay-health-monitor cron and by `box-ctl.py relay-health`.
+
+set -u
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+source "$SCRIPT_DIR/netvm-names.sh"
+
+FAILED=0
+for node in muse pip 646 opm; do
+  netvm_names "$node"
+  url="http://${PEER_IP}:${CDP_PORT}/json/version"
+  code=$(curl -s -m 8 -o /dev/null -w "%{http_code}" "$url" 2>/dev/null || echo "000")
+  echo "${node}:${code}"
+  if [ "$code" != "200" ]; then
+    echo "FAIL: ${node} relay ${PEER_IP}:${CDP_PORT} returned ${code}" >&2
+    FAILED=1
+  fi
+done
+exit $FAILED