Integrate verify-pr-status.sh into heartbeat + stabilize env schema

Subtask of recurring CI-watch trust issue. Update active-ci-watch.env writes to always include REPO, STATE, REVIEW_DECISION, MERGE_STATE_STATUS, HEAD_REF_OID, LAST_COMMIT_STATUS. Make the heartbeat call bin/verify-pr-status.sh when STATUS=watching. Add a self-test that simulates drift and confirms the script updates the env file. This closes the gap between tool shipped and tool exercised.