chore(docker): add HEALTHCHECK to Dockerfile

[cmeans-claude-dev]

Trivy's Dockerfile misconfiguration scan (#370 / landed in PR trivy integration) reports:

DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile

The severity is LOW so trivy does not fail CI on it, but the finding is legitimate — the container has no HEALTHCHECK, so Docker's built-in container health signal always reports "no health check" / UNKNOWN.

The server exposes /health on AWARENESS_PORT (8420 by default). A minimal HEALTHCHECK could be:

```dockerfile
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3
CMD curl -fsS http://127.0.0.1:\${AWARENESS_PORT:-8420}/health || exit 1
```

Caveats to work through before landing:

• python:3.13-slim doesn't ship curl. Either install it (adds ~1 MB), use wget --quiet --spider (also not present on slim), or rely on Python: CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:\${AWARENESS_PORT:-8420}/health', timeout=3)".
• start-period needs to be longer than the worst-case alembic upgrade head the entrypoint runs on first boot. Observe actual startup time; 30s is a guess.
• HAProxy on holodeck already does its own health check against /health externally — the Dockerfile HEALTHCHECK is for local docker run / compose users.

Acceptance

• HEALTHCHECK instruction added with a working probe for the default transport (streamable-http)
• Local docker run shows (healthy) in docker ps within start-period
• Trivy DS-0026 no longer reported

References

• Trivy: https://avd.aquasec.com/misconfig/ds-0026
• Parent trivy integration PR: (fill in after PR opens)