fix(ci): harden community image smoke

scripts/docker-http-healthcheck.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+port="${1:?port is required}"
+path="${2:?path is required}"
+
+if [[ ! "$port" =~ ^[0-9]{1,5}$ ]] || (( port < 1 || port > 65535 )); then
+    exit 64
+fi
+
+if [[ "$path" != /* || "$path" == *$'\r'* || "$path" == *$'\n'* ]]; then
+    exit 64
+fi
+
+# Bash provides /dev/tcp without adding a network client package to the runtime
+# image. Compose still applies its own five-second timeout to the whole probe.
+exec 3<>"/dev/tcp/127.0.0.1/${port}"
+printf 'GET %s HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n' "$path" >&3
+
+IFS=$'\r' read -r -t 2 status <&3
+case "$status" in
+    'HTTP/1.0 200 '*|'HTTP/1.1 200 '*) ;;
+    *) exit 1 ;;
+esac