Refine probes based on k3d cluster verification

Every chart was installed twice in a throwaway k3d cluster (origin/main
vs this branch) with real Postgres/Redis/dex instances and observed for
readiness ordering, stability and dependency-outage behavior. Findings:

- voucher-vault: Django only accepts Hosts 127.0.0.1 and the configured
  DOMAIN; the default probe Host (pod IP) always got 400. Probes now
  send 'Host: 127.0.0.1'.
- zipline: /api/healthcheck includes the database, so liveness now uses
  '/' (readiness/startup keep /api/healthcheck). Verified live: on a
  Postgres outage the pod turns NotReady within 30s and is never
  restarted by the kubelet.
- outline: '/' also returns 500 when the database is down, so there is
  no dependency-free endpoint; all three probes use /_health.

.watch-pr.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Throwaway PR watcher (not committed). Exits when the PR leaves OPEN state
+# or any review/issue comment appears.
+REPO=jk-cluster/helm-charts
+PR=21
+while true; do
+  STATE=$(gh pr view $PR --repo $REPO --json state --jq .state 2>/dev/null)
+  RC=$(gh api repos/$REPO/pulls/$PR/comments --jq length 2>/dev/null)
+  IC=$(gh api repos/$REPO/issues/$PR/comments --jq length 2>/dev/null)
+  if [ -n "$STATE" ] && [ "$STATE" != "OPEN" ]; then break; fi
+  if [ -n "$RC" ] && [ "$RC" != "0" ]; then break; fi
+  if [ -n "$IC" ] && [ "$IC" != "0" ]; then break; fi
+  sleep 90
+done
+echo "STATE=$STATE REVIEW_COMMENTS=$RC ISSUE_COMMENTS=$IC"