docker: add HEALTHCHECK probing /health

The binary doubles as its own healthcheck client via the SDK's
-healthcheck flag, so the probe works in the scratch image
(no shell, no curl, no wget).

Dockerfile

@@ -13,4 +13,6 @@ FROM scratch
 COPY --from=builder /checker /checker
 USER 65534:65534
 EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD ["/checker", "-healthcheck"]
 ENTRYPOINT ["/checker"]