fix(ci): run dashboard health probes inside container

[TH3478]

Summary

• Run the dashboard health and readiness probes from inside the dashboard container.
• Keep the dashboard in local trust mode instead of trusting the Docker bridge network.
• Add a regression assertion that prevents the workflow from falling back to host-side probes.
• Add a focused Task Packet so the repository boundary check authorizes this standalone CI fix.

Root cause

The container-full-stack workflow published the dashboard on 127.0.0.1:8080 and then probed it from the GitHub Actions host. Docker port forwarding presents that request to the backend as the bridge gateway (for example, 172.18.0.1), so the backend correctly rejected it with 403 untrusted_client under the default local trust policy.

The workflow now probes 127.0.0.1:8080 through docker compose exec, matching the dashboard's existing container health-check path without weakening the inbound HTTP trust boundary.

Validation

• python3 -m pytest tests/unit/test_container_baseline.py tests/unit/test_container_profiles.py -q — 34 passed
• docker compose config --quiet — passed
• Workflow YAML parsing — passed
• git diff --check — passed

The local environment does not provide Ruff or actionlint; the corresponding GitHub checks will validate them remotely.

Hosted validation on commit 56e6f58 passed all 10 reported checks. The static-and-cpu-image job completed the image build, CPU smoke, in-container dashboard health/readiness probes, container contract checks, SBOM generation, and vulnerability scan successfully.

Scope

This PR changes only the container CI workflow, its regression test, and the focused Task Packet authorizing those paths. It does not change the backend trust policy, Compose security settings, application behavior, or the Issue #168 implementation.

Related to #340.

[Quchaosheng]

已审查当前提交 56e6f58：10 个 hosted checks 全部通过。修复将 health/ready 探针移入 dashboard 容器，保持 local trust 边界不变，变更范围与 Task Packet 一致。Approve。合并前建议同步最新 main（当前 main 为 c2a86ad，PR 基线仍为 3907f90）并确认 CI 仍为绿色。