fix(checks): process check is opt-in for url-fronted services

The ontology's stated intent was "http when it has a url, else a process
check", but the implementation emitted BOTH for every url-service — so ~17
fronted services carried a redundant process check that, under worst-of
aggregation, let a fragile supplementary probe (wrong unit name, unreachable
host, no guest agent) veto two healthy http checks and report the service
"down" while it was up (authentik, zimaos, house, matrix, ...).

buildKind now emits a process check only for services WITHOUT a url, or when
an explicit probe_unit opts into binary-level depth. http is the canonical
service-liveness probe (tests the real endpoint through the TLS terminator);
the redundant process checks were removed.

internal/checkdefaults/defaults.go

@@ -213,7 +213,17 @@ func buildKind(kind string, t Target, attrs map[string]any, host, user string, p
 				break
 			}
 		}
+		// Ontology intent: "http when it has a url, else a process check." A
+		// url-fronted service is already liveness-probed via http (the real
+		// endpoint, through the TLS terminator); the process check is redundant
+		// and fragile (needs host access + the exact unit/container name), and
+		// under worst-of aggregation it lets a broken supplementary probe veto
+		// a working service. Emit it only for services WITHOUT a url, or when
+		// an explicit probe_unit opts into binary-level depth.
 		if unit == "" {
+			if httpURL(t, attrs) != "" {
+				return nil, "url present and no probe_unit; http check covers liveness"
+			}
 			unit = t.Name
 		}
 		if unit == "" {