sure: fix the readiness probe, the ephemeral-storage budget and HOME

Second install-test run, three findings, all measured:

- Readiness on "/" failed with "http: server gave HTTP response to HTTPS
  client" on a pod that was answering correctly. The kubelet's HTTP prober
  follows redirects to the same host, and with RAILS_ASSUME_SSL=true the
  app builds its redirect as https://<pod-ip>:3000/registration/new, which
  Puma does not speak. The probe now runs curl without -L and accepts
  2xx-3xx itself. The same log also proves what the probe is for: against
  an empty database the redirect target was /registration/new, the branch
  User.count decides, so the path really does reach Postgres.
- The pod was evicted within two minutes of every start: "ephemeral local
  storage usage exceeds the total limit of containers 60Mi". emptyDirs and
  the stdout log both count there, and the image rebuilds its Bootsnap
  cache under /rails/tmp on every start because the emptyDir hides the one
  baked into the image. The request is now 256Mi (limit 768Mi) per app
  container - headroom, not a measurement.
- /home/rails is read-only, so Bundler created a throwaway home under
  TMPDIR on every invocation, worker probe included. HOME now points at a
  directory the init container creates.

The CI postgres fixture gets -d sure on its readiness probe, so the server
stops logging a missing database that nothing asked for.

ci/sure/fixtures.yaml

@@ -64,8 +64,13 @@ spec:
           ports:
             - containerPort: 5432
           readinessProbe:
+            # -d names the database the chart actually uses. Without it
+            # pg_isready asks for a database named after the user and the
+            # server logs 'FATAL: database "ci" does not exist' every five
+            # seconds - noise that reads like a chart problem in the diagnostics
+            # dump when something else fails.
             exec:
-              command: ["pg_isready", "-U", "ci"]
+              command: ["pg_isready", "-U", "ci", "-d", "sure"]
             periodSeconds: 5
           volumeMounts:
             - name: data