fix: address CodeRabbit review feedback on PR #141

- Pin alpine:3.21 to correct digest (1f390db) in Dockerfile.goreleaser
- Pin go-licenses to @v2.0.1 instead of @latest in release-engine.yml
- Update stale comment in server.go: /readyz no longer uses worker/reaper
  liveness checkers; explain the intentional design decision

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/release-engine.yml

@@ -46,7 +46,7 @@ jobs:
 
       - name: Generate NOTICE
         run: |
-          go install github.com/google/go-licenses@latest
+          go install github.com/google/go-licenses@v2.0.1
           go-licenses report ./... > NOTICE
         working-directory: packages/engine
 

packages/engine/Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
+FROM alpine:3.21@sha256:1f390db9d9746cc317e16a98a8be2854c599abcbf04d45b6320b040e72034e33
 
 RUN apk add --no-cache ca-certificates tzdata \
     && addgroup -S mantle \

packages/engine/internal/server/server.go

@@ -238,7 +238,8 @@ func (s *Server) Start(ctx context.Context) error {
 		go s.pollQueueDepth(ctx, cfg.Engine.ReaperInterval)
 	}
 
-	// Health endpoints (registered after engine components so checkers are populated).
+	// Health endpoints. /readyz checks DB connectivity only; worker/reaper
+	// liveness is no longer gated here to avoid flapping between poll cycles.
 	mux.Handle("/healthz", health.HealthzHandler())
 	mux.Handle("/readyz", health.ReadyzHandler(s.DB))