fix(services): make the Redis and Valkey health checks prove a write

[vishr]

Closes #76.

The defect

redis-cli -a "$REDIS_PASSWORD" ping | grep -q PONG

Redis answers PONG while refusing every write. When a background save fails and stop-writes-on-bgsave-error is enabled — Redis's own default — the server serves reads and replies MISCONF to writes. Valkey has the same shape.

Onebox gates rollouts on that answer. So the probe certified the service healthy exactly when the behaviour its callers depend on was gone: dependent workloads started, the deploy converged, and every counter, session, queue and rate-limiter write failed against a dependency the system had just approved.

The fix

redis-cli -a "$REDIS_PASSWORD" set ob:health 1 EX 30 | grep -qx OK

SET exercises the path the probe is meant to cover, and MISCONF fails it. The key is namespaced so it cannot collide with an application key, and EX bounds it — one key held, never accumulated.

grep -qx rather than grep -q '^OK$' is deliberate. The anchored form reads better and would have been wrong: escapeDollars doubles every $ in generated content, so $ would have reached Compose as $$ and been interpolated. Whole-line matching needs no $. Verified in the rendered output — the credential still renders -a "$$REDIS_PASSWORD", unchanged.

Scope, shown by the digests

Six frozen corpus digests move, all of them redis=. Application digests and every other service digest are byte-identical:

lines mentioning redis or valkey: 12
lines without them: 0

That is the evidence this touched only the two drivers it claims to.

Operational note

This is a service-definition change: the first deploy after upgrading recreates the redis and valkey services. Unavoidable — the old definition is the defect.

Tests

Regression tests assert the probe writes, has a TTL, keeps the escaped credential, carries no unescaped $, and explicitly guard against a return to a connection-only ping. Non-vacuous, verified by restoring the ping probe:

--- FAIL: TestRedisFamilyHealthChecksProveAWrite
    redis health check does not write

Verified

just check, golangci-lint run ./..., go test -race ./....

Related

Sequencing note for #75: with AOF disabled on ephemeral Redis, the stop-writes-on-bgsave-error path largely disappears, so this probe's value differs by persistence mode. Landing it first means #75 inherits a write-sensitive probe rather than having to add one.