sure: fix the readiness probe, the ephemeral-storage budget and HOME

Second install-test run, three findings, all measured:

- Readiness on "/" failed with "http: server gave HTTP response to HTTPS
  client" on a pod that was answering correctly. The kubelet's HTTP prober
  follows redirects to the same host, and with RAILS_ASSUME_SSL=true the
  app builds its redirect as https://<pod-ip>:3000/registration/new, which
  Puma does not speak. The probe now runs curl without -L and accepts
  2xx-3xx itself. The same log also proves what the probe is for: against
  an empty database the redirect target was /registration/new, the branch
  User.count decides, so the path really does reach Postgres.
- The pod was evicted within two minutes of every start: "ephemeral local
  storage usage exceeds the total limit of containers 60Mi". emptyDirs and
  the stdout log both count there, and the image rebuilds its Bootsnap
  cache under /rails/tmp on every start because the emptyDir hides the one
  baked into the image. The request is now 256Mi (limit 768Mi) per app
  container - headroom, not a measurement.
- /home/rails is read-only, so Bundler created a throwaway home under
  TMPDIR on every invocation, worker probe included. HOME now points at a
  directory the init container creates.

The CI postgres fixture gets -d sure on its readiness probe, so the server
stops logging a missing database that nothing asked for.

sure/templates/sure.sfs.yaml

@@ -53,10 +53,12 @@ spec:
         # file yet.
         #
         # The fix is a directory that is writable without being world-writable.
-        # This init container creates one per app container inside the same
-        # emptyDirs (mode 0700, owned by the pod's uid) and both containers get
-        # TMPDIR pointed at it. It runs as the same non-root uid as the app and
-        # needs no capability at all: the emptyDir root is 0777, so creating an
+        # This init container creates two of them per app container inside the
+        # same emptyDirs (mode 0700, owned by the pod's uid): "ruby" for TMPDIR,
+        # and "home" for HOME - the image's /home/rails is read-only, and
+        # Bundler answers that by creating a throwaway home under TMPDIR on
+        # every single invocation. It runs as the same non-root uid as the app
+        # and needs no capability at all: the emptyDir root is 0777, so creating an
         # entry in it is allowed, and chmod on a directory one has just created
         # needs no privilege. That is deliberately weaker than the chown-as-root
         # init container paperless-ngx needs.
@@ -71,7 +73,7 @@ spec:
             - /bin/bash
             - -ec
             - |
-              for dir in /web-tmp/ruby /worker-tmp/ruby; do
+              for dir in /web-tmp/ruby /web-tmp/home /worker-tmp/ruby /worker-tmp/home; do
                 mkdir -p "$dir"
                 chmod 700 "$dir"
               done