test: /readyz returns 200 when setup_required regression guard (#1099 follow-up)

[brandonrc]

Background

PR #180 attempted a regression guard for artifact-keeper#1099 (`/readyz` returning 503 when `state.setup_required = true`, breaking K8s readiness and pod-restart loop). The 2-judge review pass caught two compounding problems:

Problem 1: the fix commit is not on main

```bash
$ git branch -r --contains 22b99a7
origin/chore/1031-ci-run-ignored
origin/chore/1054-storage-coincide-assert
origin/chore/955-forward-port-main
origin/chore/ci-concurrency-and-disable-alpine
... (topic branches only, NO origin/main)
```

The PR page says #1099 is merged but `origin/main` does not include `22b99a7`. The deployed backend at `/readyz` STILL returns 503 when `setup_required=true`. Without the fix on main, a regression guard cannot exist.

Problem 2: schema mismatch even if the fix lands

Current main's `/readyz` response shape:

```json
{
"status": "healthy|unhealthy",
"checks": {
"database": { "status": "healthy|unhealthy", "message": "..." },
"migrations": { "status": "healthy|unhealthy", "message": "..." },
"setup_complete": { "status": "healthy|unhealthy", "message": "..." }
}
}
```

`setup_complete` is a NESTED `CheckStatus` object under `.checks`, NOT a top-level string. The dropped test used `jq .setup_complete == "incomplete"` which would never match the real schema.

What's needed

Two-step plan:

Step 1: confirm the fix actually lands on main

Either (a) merge a forward-port of #1099 to main, or (b) re-verify against the current main `health.rs` whether `/readyz` really gates 503 on `setup_required`. If the behavior already matches the #1099 contract (200 even when setup is incomplete) via a different commit, document which commit.

Step 2: write the test against the actual schema

Once Step 1 is settled, the test should:

1. Hit `GET /readyz`
2. Assert response is 200 (regardless of setup state)
3. Read `.checks.setup_complete.status` (the actual schema, not a top-level string)
4. If `.checks.setup_complete.status == "unhealthy"` AND HTTP status was 200, this confirms the fix is preserved
5. If `.checks.setup_complete.status == "unhealthy"` AND HTTP status was 503, this is the #1099 regression — fail the test

Step 3 (optional): fresh-deploy fixture

#179 (verify #152 suites against real backend) is the natural home for a deploy fixture that exercises the un-bootstrapped state. Until that lands, the regression branch of this test can only be exercised by a release-gate run against a fresh backend image before admin bootstrap completes.

Refs

• artifact-keeper#1099 `22b99a7` (NOT on origin/main as of 2026-05-18)
• #180 review thread (judge findings)
• #179 (fresh-deploy fixture follow-up)