feat(platform): declare the ingest worker exempt from the health check

[ExtraToast]

knowledge-ingest-worker is a RabbitMQ consumer. Its cluster manifest declares no ports and no readinessProbe/livenessProbe — there is no HTTP surface to probe. The SC-11 health_declared check requires a health.path from every workload, so it could not be satisfied for this deployment; it reported a bare fail with nothing actionable behind it.

This repository has no deploy-preview workflow, so the scorecard had never been evaluated against this deployment.yml and the gap went unreported until the shared checker was run here.

Change

- name: knowledge-ingest-worker
  # A RabbitMQ consumer with no HTTP surface: its cluster manifest declares
  # no ports and no probes, so there is nothing to probe. mandatory: false
  # records that deliberately, rather than leaving health undeclared and
  # indistinguishable from an oversight.
  health:
    mandatory: false

The check now reports:

| ✅ | health_declared | pass | exempt by health.mandatory: false: knowledge-ingest-worker |

The exemption stays visible on every preview instead of being inferred from an absent field. Omitting health altogether is still a failure (JorisJonkers-dev/github-workflows#100), so an oversight remains distinguishable from a decision.

No deployment impact

diff -rq over both out/manifests and out/apply, rendered before and after the change, reports no differences. The worker still renders with no probes. health.mandatory was already in the deployment schema and previously unused.

Pins

github-workflows moves to v0.16.0 — the release where the check honours this field, and where a pin actually selects the action code that runs (until v0.15.2, an empty job_workflow_sha meant every consumer ran main regardless of its pin).