anubis: fix image ref typo in deploy pull, health probe exec form, unit alias tag

Three compounding deploy-handler bugs found by live deployment:
- podman image exists/pull used a mixed-case ghcr.io ref that podman's
  reference parser rejects before any network I/O (repository name must be
  lowercase); all refs now lowercase — ghcr resolves case-insensitively.
- the unit runs the image under a localhost/ alias tag: this host's podman
  5.7 quadlet path fails container create with 'image not known' for
  registry-prefixed refs even when present in storage (verified live).
- the health probe was shell-form and the distroless ko-build image has no
  shell; HealthCmd is now a JSON exec-form array, which passes through the
  quadlet generator's argv assembly verbatim.

Tests updated to assert the alias-tag reality plus the pull guard.

tests/anubis.bats

@@ -23,8 +23,14 @@ setup() {
 }
 
 @test "the image is pinned to an exact upstream tag and never pulled at boot" {
-    grep -qE '^Image=ghcr\.io/techaroq/anubis:v[0-9]+\.[0-9]+\.[0-9]+$' "$UNIT"
+    # The unit runs a localhost/ alias tag of the canonical upstream ref
+    # (podman 5.7 quadlet quirk: registry-prefixed refs fail container
+    # create on this host). The pin is still an exact upstream tag — the
+    # deploy handler pulls the canonical ghcr.io ref and re-tags the alias;
+    # nothing is pulled at boot (Pull=never).
+    grep -qE '^Image=localhost/techarohq/anubis:v[0-9]+\.[0-9]+\.[0-9]+$' "$UNIT"
     grep -q '^Pull=never$' "$UNIT"
+    grep -q 'podman pull ghcr\.io/techarohq/anubis:v[0-9]*\.[0-9]*\.[0-9]*' "$REPO_ROOT/scripts/deploy-remote.sh"
 }
 
 @test "anubis publishes no host port — it is internal-network-only" {