The image apps build FROM, with its health check (closes #45)

The Dockerfile's last stage is now the image of "Deployment" in SPEC.md:
Ubuntu 26.04 with ca-certificates, nix-bin and runit from a dated
snapshot whose InRelease files are checked by hash, nixpkgs from its
release file checked by SHA-256, runsvinit built at a fixed commit, and
smallwebwaf as a runit service. smallwebwaf answers
/_smallwebwaf/healthz, and `smallwebwaf healthcheck`, which takes no
further argument, is the image's HEALTHCHECK. script/example-app builds
an app on the image and checks it end to end.

The Nix profile comes last on the PATH: first, busybox from nixpkgs
replaced runit's own runsvdir and sv. SPEC.md is corrected to match
what was built.

Model: opus-5-5

internal/smallwebwaf/smallwebwaf_test.go

@@ -24,8 +24,9 @@ const (
 	// testVersion is the version the tests give smallwebwaf.
 	testVersion = "test"
 	// localhost is where the tests listen.
-	localhost  = "127.0.0.1"
-	listenAddr = "SWWAF_LISTEN_ADDR"
+	localhost   = "127.0.0.1"
+	listenAddr  = "SWWAF_LISTEN_ADDR"
+	upstreamURL = "SWWAF_UPSTREAM_URL"
 )
 
 // output collects what smallwebwaf writes on stdout.
@@ -143,8 +144,8 @@ func TestServesUntilToldToStop(t *testing.T) {
 
 	go func() {
 		exited <- run(ctx, map[string]string{
-			listenAddr:           localhost + ":0",
-			"SWWAF_UPSTREAM_URL": app.URL,
+			listenAddr:  localhost + ":0",
+			upstreamURL: app.URL,
 		}, out)
 	}()
 
@@ -177,7 +178,7 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL string) {
 	settings, _ := line["settings"].(map[string]any)
 	want := map[string]any{
 		listenAddr:                            localhost + ":0",
-		"SWWAF_UPSTREAM_URL":                  appURL,
+		upstreamURL:                           appURL,
 		"SWWAF_TRUSTED_PROXIES":               "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
 		"SWWAF_CLIENT_REQUEST_TIMEOUT":        "60s",
 		"SWWAF_CLIENT_RESPONSE_TIMEOUT":       "30m",