feat: add standardized healthz contract

[mlhiter]

Summary

• Add an unauthenticated /healthz endpoint that returns 200 with {"service":"dataflow","status":"ok"} and Cache-Control: no-store.
• Keep /health as a legacy compatibility endpoint.
• Move the Helm startup, liveness, and readiness probes, plus the Sealos app health annotation, to /healthz.
• Update operational and integration docs to use the stable health check path.

Verification

• go test ./...
• go build ./...
• pnpm run typecheck
• pnpm run build
• pnpm run lint
• helm lint deploy/charts/dataflow
• helm template dataflow deploy/charts/dataflow --set app.enabled=true | rg -n "health-url|startupProbe|livenessProbe|readinessProbe|path: /healthz"
• git diff --check
• Isolated clean-worktree verification with the same patch applied to the base commit.