fix(observability): give loki an exec-form healthcheck in its image

The loki unit came up 'unhealthy' after the quadlet cutover. Cause: a unit's
HealthCmd reaches podman as CMD-SHELL, i.e. /bin/sh -c, and the loki image is
distroless — no shell exists in it. The busybox command itself works (probed
by hand: /ready answers 'ready'); it was the shell wrapper that could not run.
podman does not accept an exec-form command through --health-cmd either: it
stores a JSON array as one literal argument.

The command therefore moves into dankclaw/loki/Containerfile as a
HEALTHCHECK ... CMD [...] exec form, which is what that image exists for — it
already ships the static busybox solely so a healthcheck has something to run.
podman reads the image's healthcheck when the unit declares none.

tests/caddyfile.bats

@@ -221,15 +221,16 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     done
 }
 
-@test "loki and alloy healthchecks use the busybox wget" {
-    # Both images are distroless-ish, so the healthcheck only works because
-    # the local Containerfile drops a static busybox into the image.
-    local n=0 unit
-    for unit in "$REPO_ROOT"/dankclaw/observability/quadlet/loki.container \
-                "$REPO_ROOT"/dankclaw/observability/quadlet/alloy.container; do
-        grep -q '^HealthCmd=/usr/local/bin/busybox wget' "$unit" && n=$((n + 1))
-    done
-    [ "$n" -eq 2 ] || { echo "expected 2 busybox healthchecks, found $n"; return 1; }
+@test "loki and alloy healthchecks run the busybox they ship" {
+    # Both images are distroless-ish, so a healthcheck only works because the
+    # local Containerfile drops a static busybox into the image. loki cannot
+    # take the command from the unit (podman would wrap it in CMD-SHELL and
+    # the image has no shell), so it comes from the image; alloy's image does
+    # have a shell, so its command lives in the unit.
+    grep -q '^HealthCmd=/usr/local/bin/busybox wget' \
+        "$REPO_ROOT/dankclaw/observability/quadlet/alloy.container"
+    grep -q 'CMD \["/usr/local/bin/busybox", "wget"' \
+        "$REPO_ROOT/dankclaw/loki/Containerfile"
 }
 
 @test "alloy's UI address comes from the unit, not the config file" {