docs: record social linking staging verification

docs/verification.md

@@ -144,8 +144,35 @@ environment.
 After the Activity rollout, headed Chrome rendered the updated public
 navigation, followed the Activity link to the authenticated route, and received
 the expected login redirect and flash with zero console errors or warnings.
-The currently deployed staging revision does not yet include the OAuth change;
-deployment and a browser check are recorded only after that rollout occurs.
+
+After commit `307794c`, staging was rebuilt with the optional GitHub OAuth
+boundary. Both web and both worker replicas started, the cross-node PubSub probe
+passed, public home/readiness returned HTTP 200, and the before/after database
+counts remained `2 users / 1 request / 7 messages / 14 categories / 1
+assignment / 0 activities / 0 reports / 0 social identities`.
+
+A headed Chrome E2E run then registered a uniquely named `example.invalid`
+account, consumed its confirmation link from local Mailpit, authenticated,
+opened `/profile`, and observed:
+
+- the GitHub network option and the explicit provider-disabled explanation;
+- no Verify button while both OAuth environment variables were absent;
+- a manually added Telegram link labelled `unverified`;
+- removal of that owner-controlled manual link;
+- a direct `/auth/social/github` request returning to the profile with the
+  controlled `provider is not configured` flash;
+- zero browser console errors or warnings.
+
+The exact E2E user was checked for every foreign-key relationship to `users`.
+It had only its one authentication token and no domain records after the manual
+link was removed. That exact user was then deleted through Ecto, its browser
+session became invalid, the generated Mailpit message was deleted individually,
+and the original database counts were observed again. The browser windows were
+left open.
+
+Local ignored browser evidence:
+
+- `.playwright-cli/page-2026-07-18T18-09-44-303Z.png`
 
 ## Known work before a public production launch