# Wire `spec.healthCheckPath` into a ReadinessProbe (or drop the field)

The App CRD accepts `healthCheckPath` (default `/`) but the operator never reads it — Running gates purely on Deployment replica readiness (`lego/operator/internal/controller/app_controller.go`), and the CRD comment was corrected to say so (2026-07-08 audit). Either wire it — set an HTTP `ReadinessProbe` on the container from the field in `reconcileKubernetes`, which makes replica-readiness gating real health gating for free — or decide to drop the field from the contract. Single ~45m task incl. envtest; below milestone size.

Source: 2026-07-08 docs-vs-code audit (P4 finding). Goal: docs/ADR004-deployment.md's health-gating story becomes true; Render `healthCheckPath` parity.
