fix(deploy): point agent-gateway's liveness probe at the liveness group

[ExtraToast]

Follow-up to the 0.22.0 bump, which was deliberately left out of it: agent-gateway declares only health.path, so the probe rendering introduced in schema 0.21 falls back to the readiness path for livenessProbe too.

Those are different actuator groups — readiness reports readinessState, liveness reports livenessState,ping. Sharing one path means a failing dependency fails liveness as well, so the kubelet restarts the pod instead of just removing it from endpoints. A transient outage becomes a restart loop.

The endpoint is configured, not assumed

This was held back from the estate bump because agent-gateway is not deployed, so the path could not be confirmed against a live pod. It is confirmed from source instead — services/agent-gateway/src/main/resources/application.yml:

management:
  endpoints:
    web:
      base-path: /api/actuator
  endpoint:
    health:
      probes:
        enabled: true
      group:
        liveness:
          include: livenessState,ping
        readiness:
          include: readinessState
server:
  port: 8090

/api/actuator/health/liveness exists and is explicitly grouped, on the same port 8090 the manifest already probes.

agents-login is unchanged

It is a Fastify service exposing a single /healthz with no separate groups, so one path for both probes is correct. The edit is scoped to the actuator readiness path and does not touch it.

Verification

Rendered against schema 0.22.0 and the published context @sha256:e839b908…, exit=0, no failing gates:

container	readiness	liveness
agent-gateway	/api/actuator/health/readiness	/api/actuator/health/liveness
agents-login	/healthz	/healthz

[github-actions]

Deploy Preview — agent-runtime

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:e839b90839a5f33f1038d305531d9bb2cd85a3a627a436c395c4116533321cc9
Workloads: 2 | Routes: 0 | Gatus endpoints: 2

Image refs

• agent-gateway: ghcr.io/jorisjonkers-dev/agent-runtime/agent-gateway@sha256:0000000000000000000000000000000000000000000000000000000000000000
• agents-login: ghcr.io/jorisjonkers-dev/agent-runtime/agents-login@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
➖	route_owner_authmode_declared	not_applicable	deployment declares no routes
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
➖	stateful_policy_declared	not_applicable	deployment declares no stateful workloads
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 4 check(s) not applicable: route_owner_authmode_declared, stateful_policy_declared, raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.