0.28.4 — nomos healthcheck via binary subcommand (distroless has no wget)

The nomos runtime image is gcr.io/distroless/static (no shell/wget), so the
wget-based healthcheck (D5) could never run — nomos showed docker-unhealthy
despite serving /healthz fine. Add a 'nomos healthcheck' subcommand that
self-probes NOMOS_LISTEN/healthz (exit 0 on 200), and point the compose
healthcheck at ["/nomos", "healthcheck"].

cmd/nomos/main.go

@@ -183,8 +183,30 @@ func main() {
 
 		<-ctx.Done()
 		slog.Info("nomos: shutting down")
-		srv.Shutdown(context.Background())
-		clientPool.closeAll()
+ 		srv.Shutdown(context.Background())
+ 		clientPool.closeAll()
+
+	case "healthcheck":
+		// Self-probe for Docker healthcheck. The nomos runtime image is
+		// distroless (no shell/wget), so the container can't run wget — the
+		// binary probes its own /healthz instead. Exit 0 on 200, 1 otherwise.
+		addr := os.Getenv("NOMOS_LISTEN")
+		if addr == "" {
+			addr = ":8092"
+		}
+		host := addr
+		if strings.HasPrefix(host, ":") {
+			host = "127.0.0.1" + host
+		}
+		client := &http.Client{Timeout: 3 * time.Second}
+		resp, err := client.Get("http://" + strings.TrimPrefix(host, "http://") + "/healthz")
+		if err != nil {
+			os.Exit(1)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			os.Exit(1)
+		}
 
 	default:
 		fmt.Fprintf(os.Stderr, "unknown command: %s\n", os.Args[1])