anubis: health probe in JSON exec form for the distroless image

The image has no shell (ko-build distroless; entrypoint /ko-app/anubis),
and this host's quadlet generator joins a bare HealthCmd into one
\x20-escaped argv element that podman then runs shell-form — exec of a
missing shell exits 1 and the container sits unhealthy. A JSON array in
HealthCmd passes through the generator verbatim and executes the binary
directly.

dankclaw/anubis/quadlet/anubis.container

@@ -42,11 +42,13 @@ Network=dankclaw_default
 Environment=TARGET=http://caddy:8016
 Environment=POLICY_FNAME=/policy/policy.json
 Volume=/home/dank/serverAppConfigs/dankclaw/anubis/policy.json:/policy/policy.json:ro
-# The image ships no HEALTHCHECK (distroless: no shell, binary not at
+# The image ships no HEALTHCHECK (distroless ko-build: entrypoint is
-# /app/bin), so the probe is declared here: `anubis --healthcheck` exits 0
+# /ko-app/anubis, no shell in the image), so the probe is declared here.
-# when the challenge server answers on :8923. Exec form — quadlet passes it
+# JSON exec form on purpose: this quadlet generator joins HealthCmd into a
-# to podman without a shell, which the distroless image requires.
+# single \x20-escaped argv element and podman then runs it as shell-form —
-HealthCmd=anubis --healthcheck
+# which needs a shell the distroless image does not have. A JSON array is
+# passed through verbatim and executes /ko-app/anubis directly.
+HealthCmd=["/ko-app/anubis","--healthcheck"]
 HealthInterval=15s
 HealthTimeout=5s
 HealthRetries=3