podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK,
so the first deploy failed at "Wait for the container healthcheck to pass" with
"container ... has no defined healthcheck" even though the app was up.
- Declare the same check on the hops.container unit (HealthCmd + interval,
timeout, retries, start period), the convention menu-admin already uses.
- Flush handlers right after starting, before the gate: the unit template's
restart handler otherwise runs at the end of the play, so a run that changes
only the unit would test the stale container.