Fix the Vaultwarden readiness probe

The first deploy failed its wait. The app was up -- Rocket had launched on port
80 and systemd reported the unit active -- but `podman healthcheck run` kept
returning non-zero. Podman's healthcheck plumbing is unreliable for
Quadlet-managed rootless containers: the check is registered against the *user*
systemd manager, and when that fails the check never runs, leaving `podman
healthcheck run` to report that the container has no healthcheck at all even
though the image declares one (upstream issues #26066, #25034, #22804).

Exec the image's own /healthcheck.sh instead: the identical probe (curl
http://localhost:80/alive) with no plumbing in between, and still nothing the
play has to invent. The cost is that the path is hardcoded, which the image's
Dockerfile pins, so a moved script fails as a plain 127 rather than hanging.

The wait is now a block with a rescue that prints the probe's own stdout/stderr,
the container's health status and the last 20 log lines. The bare "non-zero
return code" the plain task reported is exactly the message that hides the
reason.

The readme's verification commands and a new gotcha record why the probe is
exec'd, so nobody "fixes" it back to `podman healthcheck run`.

bitwarden/readme.md

@@ -292,7 +292,7 @@ journalctl --user -u bitwarden -f
 podman logs bitwarden
 
 # What the playbook checks for you:
-podman healthcheck run bitwarden           # the image's own probe
+podman exec bitwarden /healthcheck.sh      # the image's own probe
 podman exec bitwarden getent hosts postgres
 podman exec bitwarden getent hosts db
 
@@ -325,6 +325,19 @@ Then reboot the host and confirm the unit returns unattended — without
 
 ## Notes and gotchas
 
+- **The readiness probe is exec'd, not `podman healthcheck run`.** Podman's
+  healthcheck plumbing is unreliable for Quadlet-managed rootless containers: the
+  check is registered against the *user* systemd manager, and when that fails the
+  check never runs and `podman healthcheck run` reports that the container has no
+  healthcheck at all, even though the image declares one
+  ([podman#26066](https://github.com/containers/podman/issues/26066),
+  [podman#22804](https://github.com/containers/podman/issues/22804)). That is what
+  the first deploy here hit — the app was serving and the probe wrapper was the
+  only thing failing. The play therefore executes the image's own
+  `/healthcheck.sh` directly, which is the same probe with no plumbing in
+  between. One cosmetic consequence: `podman inspect bitwarden --format
+  '{{.State.Health.Status}}'` can stay `starting` forever, which is not a sign
+  that the app is unhealthy.
 - **The stale SQLite file.** If `~/podman-data/bitwarden/data/db.sqlite3` exists,
   the play prints a warning on every run rather than failing, because the file is
   inert while `DATABASE_URL` is set. It is not a backup. Delete it once the