feat: add the native silo healthcheck subcommand

Add 'silo healthcheck [live|ready|cluster|cluster-read]', a thin
anonymous HTTP client for the server's own /minio/health/* endpoints,
so containers without a shell, curl, or mc can still run health
checks. Design: silo.pgsty.com/compatibility/feature/healthcheck/

The check vocabulary maps 1:1 onto the health API paths; the probe
target is derived from the server's own --address/MINIO_ADDRESS
contract with HTTPS auto-detected from the certs directory, and can
be overridden with --url. Exit codes are 0/1 only (Docker reserves 2);
diagnostics (x-minio-server-status, quorum headers) go into a single
output line for docker inspect. The request is strictly anonymous (a
credentialed request would be rejected by the reserved-path guard),
the transport bypasses HTTP_PROXY, and certificate verification is
skipped to match kubelet HTTPS probe behavior. Cluster checks default
to a 15s deadline so the server's 10s cluster_deadline can elapse.

Compatibility notes: the preserved /minio/health/* path literals and
the MINIO_ADDRESS env var are upstream wire/config surface, reused on
purpose; the rebrand-guard baseline is regenerated for the new route
literals (tests included) with zero new exported symbols. The docker
entrypoint argv translation learns the new command name.

Verified: unit tests, entrypoint tests, go vet, plus an end-to-end
run against a live server covering all four checks, --maintenance
(412), --json, usage errors, unreachable and timeout paths.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dockerscripts/docker-entrypoint.sh

@@ -13,7 +13,7 @@ case "${1:-}" in
 		;;
 	silo)
 		;;
-	-*|server|fmt-gen)
+	-*|server|fmt-gen|healthcheck)
 		set -- silo "$@"
 		;;
 esac

dockerscripts/docker-entrypoint_test.sh

@@ -40,6 +40,7 @@ run_case() {
 run_case default $'silo\n'
 run_case server $'silo\nserver\n/data\n' server /data
 run_case option $'silo\n--version\n' --version
+run_case healthcheck $'silo\nhealthcheck\nready\n' healthcheck ready
 run_case explicit-silo $'silo\nserver\n/data\n' silo server /data
 run_case legacy-minio $'silo\nserver\n/data\n' minio server /data