fix(mcp): let the adapter sidecars report whether they serve

svc-ai-mcp-adapter declares its own probe - http_status on /health,
rendered through container_healthcheck - but the four roles that run it
write their sidecar block inline and dropped both halves. Without a
probe docker calls the container up while the process lives, which says
nothing about whether it answers.

CI named only baserow, because the rule skips a service the inventory
does not deploy and the other three have MCP off there. They carry the
same defect, so all four get the declaration.

The check cannot run locally at all: it sweeps every declared image
through the GHCR mirror, whose prefix only CI writes, so it skips here
by design. make quality-high was green and could not have been anything
else.

e3e81e816f made services.yml the place a probe is declared; the sidecars
were added afterwards and never picked it up.

roles/web-app-baserow/meta/services.yml

@@ -99,6 +99,9 @@ baserowmcp:
   mem_reservation: 16m
   mem_limit: 24m
   pids_limit: 64
+  healthcheck:
+    flavor: http_status
+    path: health
   ports:
     internal:
       http: 8080

roles/web-app-baserow/templates/compose.yml.j2

@@ -39,6 +39,7 @@
       ADAPTER_UPSTREAM_PATH_SUFFIX: "sse"
     expose:
       - "{{ BASEROW_MCP_PORT }}"
+    {{ lookup('container_healthcheck', 'baserowmcp') | indent(4) }}
     {{ lookup('container_networks', own_network_only=True, provider_self_alias=False) | indent(4) }}
     {{ lookup('depends_on', {'baserow': 'service_healthy'}) }}
   {% endif %}

roles/web-app-gitea/meta/services.yml

@@ -93,6 +93,9 @@ giteamcp:
   mem_reservation: 16m
   mem_limit: 24m
   pids_limit: 64
+  healthcheck:
+    flavor: http_status
+    path: health
   ports:
     internal:
       http: 8080

roles/web-app-gitea/templates/compose.yml.j2

@@ -54,6 +54,7 @@
       ADAPTER_PORT: "{{ GITEA_MCP_PORT }}"
     expose:
       - "{{ GITEA_MCP_PORT }}"
+    {{ lookup('container_healthcheck', 'giteamcp') | indent(4) }}
     {{ lookup('container_networks', own_network_only=True, provider_self_alias=False) | indent(4) }}
       {{ GITEA_MCP_UPSTREAM_NETWORK }}:
   {% endif %}

roles/web-app-jenkins/meta/services.yml

@@ -75,6 +75,9 @@ jenkinsmcp:
   mem_reservation: 16m
   mem_limit: 24m
   pids_limit: 64
+  healthcheck:
+    flavor: http_status
+    path: health
   ports:
     internal:
       http: 8080

roles/web-app-jenkins/templates/compose.yml.j2

@@ -47,6 +47,7 @@
       ADAPTER_UPSTREAM_AUTH_FORMAT: {{ JENKINS_MCP_UPSTREAM_AUTH_FORMAT | to_json }}
     expose:
       - "{{ JENKINS_MCP_PORT }}"
+    {{ lookup('container_healthcheck', 'jenkinsmcp') | indent(4) }}
     {{ lookup('container_networks', own_network_only=True, provider_self_alias=False) | indent(4) }}
     {{ lookup('depends_on', {'jenkins': 'service_healthy'}) }}
   {% endif %}

roles/web-app-mattermost/meta/services.yml

@@ -122,6 +122,9 @@ mattermostmcp:
   mem_reservation: 16m
   mem_limit: 24m
   pids_limit: 64
+  healthcheck:
+    flavor: http_status
+    path: health
   ports:
     internal:
       http: 8080

roles/web-app-mattermost/templates/compose.yml.j2

@@ -42,6 +42,7 @@
       ADAPTER_PORT: "{{ MATTERMOST_MCP_PORT }}"
     expose:
       - "{{ MATTERMOST_MCP_PORT }}"
+    {{ lookup('container_healthcheck', 'mattermostmcp') | indent(4) }}
     {{ lookup('container_networks', own_network_only=True, provider_self_alias=False) | indent(4) }}
   {% endif %}