0.28.4 — nomos healthcheck via binary subcommand (distroless has no wget)

The nomos runtime image is gcr.io/distroless/static (no shell/wget), so the
wget-based healthcheck (D5) could never run — nomos showed docker-unhealthy
despite serving /healthz fine. Add a 'nomos healthcheck' subcommand that
self-probes NOMOS_LISTEN/healthz (exit 0 on 200), and point the compose
healthcheck at ["/nomos", "healthcheck"].

docker-compose.yml

@@ -233,8 +233,10 @@ services:
     stop_grace_period: 10s
     mem_limit: 512m
     cpus: 1.0
+    # nomos runs on a distroless image (no shell/wget), so the healthcheck
+    # uses the binary's own `healthcheck` subcommand to self-probe /healthz.
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8092/healthz"]
+      test: ["CMD", "/nomos", "healthcheck"]
       interval: 30s
       timeout: 5s
       retries: 3