A bare GET / previously returned an empty 404, which reads as an outage
even while the service is healthy. The root now redirects to
/diagnostics when the dashboard is enabled and otherwise returns a
small JSON status pointing at /health/live. The route is excluded from
the OpenAPI description, so the frozen v1 surface is unchanged.
The chiseled runtime image ships no shell or curl, so the container
healthcheck re-enters the server assembly with --health-probe, which
queries the local liveness endpoint and reports through the exit code.
Dockerfile and compose both wire the probe (30s interval, 3 retries).