templates: three health probes dial where the app listens (R-618)

tandoor 8080->80, wger 80->8000, zipline /api/health->/api/healthcheck.

The probe dials <container-name>:<port><path> from inside the compose network, so the port is the
one the process LISTENS on. Each fix matches the port/path that the SAME service's own compose
healthcheck already dials on 127.0.0.1 — the oracle that was sitting in the file all along.

This is P1 and not cosmetic: the guarded update's `verifying` phase waits on this probe, so
`failAndHold` stopped a working app at the end of a SUCCESSFUL update. Measured on 9202 2026-09-21.

No image: line moved, so no catalog_since moves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/zipline/.felhom.yml

@@ -75,7 +75,10 @@ healthcheck:
   checks:
     - type: api
       port: 3000
-      path: "/api/health"
+      # /api/healthcheck, not /api/health: this probe is `api` WITH an expect
+      # block, so a 404 on the wrong path reads as unhealthy. zipline's own compose healthcheck
+      # dials /api/healthcheck (R-618).
+      path: "/api/healthcheck"
       expect:
         status: 200