Healthcheck

Readiness probe (strict): Kea online AND desired config applied. Gates both pod readiness and the externally exposed NLB health endpoint. A pod becomes ready -- and therefore a valid external DHCP target -- only when Kea is online AND the expected desired configuration has been successfully applied/verified. An unconfigured pod (bootstrap config only) is never ready. A config mismatch makes the pod UNREADY (triggering reconciliation) but does NOT restart a live Kea; the readiness path never recycles the Kea container.