Fail closed in verifyChecksum; drop the Contact.get fallback

If Contact.validateChecksum threw for any reason, verifyChecksum retried
with Contact.get plus an unknown `checksum` param. Our API key is
privileged, so if Civi ever ignored that param the probe would resolve
the contact and accept any checksum. Treat errors as invalid instead,
and reject non-positive/non-integer contact ids up front.

app/api/health/route.ts

@@ -245,9 +245,8 @@ async function probeStageOptionGroup(): Promise<CheckResult> {
 async function probeChecksumApi(): Promise<CheckResult> {
   // Tries to call validateChecksum with a deliberately invalid checksum.
   // If the API exists, we get back {valid: false} or similar — that's
-  // success for THIS check (the API responded). If the API doesn't exist
-  // we fall back to a Contact.get probe in verifyChecksum, which will
-  // also fail gracefully.
+  // success for THIS check (the API responded). If the API doesn't exist,
+  // verifyChecksum fails closed and every form link will be rejected.
   try {
     await civi("Contact", "validateChecksum", {
       contactId: 1,
@@ -266,7 +265,7 @@ async function probeChecksumApi(): Promise<CheckResult> {
       return {
         check: "contact_validate_checksum_api",
         ok: false,
-        detail: `validateChecksum action not present in this Civi version. The verifyChecksum() helper falls back to a Contact.get probe with cs param. Detail: ${msg}`,
+        detail: `validateChecksum action not present in this Civi version. verifyChecksum() fails closed, so every form link will be rejected until Civi is upgraded. Detail: ${msg}`,
       };
     }
     return {