My list is super simple, but these are the good old tried and true commands I've used more times than I can count over the years.
fw stat. Number one go to just to see what the heck is going on. Is a policy loaded? When? Yeah, I just pushed, but did the firewall actually get it? And yes, I've seen a policy push and the firewall report an older version in state. Is it loaded on all the interfaces? Over the years, this has been the most consistent starting place when shooting a problem. Many interesting roads began with fw stat.
fw unloadlocal. Absolute life saver. This one has pulled my chestnuts from the fire on many occasions. Mostly to clear 18000 series port errors between management server and firewall, but highly useful on other occasions. And thank goodness for persistent ssh connections after a bad policy push! (Yeah, I know, it's not good to have a firewall sitting there without a policy, but when it's 2:00 a.m., "now" was five hours ago and there is nobody in the DC to kick the box if it doesn't come back... fw unloadlocal and move forward.)
cpstart/stop/restart. Another handy deal that didn't kill ssh sessions. I've been amazed how many times a simple boot has cleared things up. Often needed after doing heart surgery on various files, as well. Great for looking at which daemons and processes are coming up and then throwing a flag on the field. Clear elg files, cprestart and start fresh. Great way to see what's going wrong right now. Honestly, a pretty critical tool just for figuring out whether to continue shooting, back off a version or rebuild a gateway.
Honorable mentions:
I cannot walk away without mentioning fwm ike_reset - the mother of all VPN shooting bombs and fwm load [target - by freaking IP address!]. Yeah, yeah, API. But I miss fwm. It had certain powers that the API will never understand. And didn't always need objects to work. Nice sledge hammer. But, no more. Sad panda.