fix(admin-token-issuer-proxy): separate readiness from liveness

[mikeyrcamp]

What

• use the proxy's dependency-aware /readyz endpoint for Kubernetes readiness
• keep /healthz as the process liveness endpoint

Why

The admin token issuer proxy can start before API Keys has completed a cold
start. A compatible application image keeps the process live while retrying
transient metadata failures, but it must not receive traffic until that
metadata is initialized.

Related to #1229.

Validation

• focused helm template assertion confirms readiness renders /readyz
• helm lint deploy/helm/admin-token-issuer-proxy/chart ...
• tools/ci/check-helm-charts (14 charts linted and rendered)
• k3d validation using this chart and the native candidate image from feat(admin-token-issuer-proxy): migrate service and tolerate API Keys cold start #1418:
  API Keys initially had no endpoints; /healthz returned 200, /readyz and
  token issuance returned 503, and the pod stayed at 0 restarts. After API Keys
  became available, /readyz returned 200, the pod became Ready with 0
  restarts, and Helm --wait completed.

Dependency

This PR remains draft until #1418 is merged, application v1.1.0 is built,
and nvcr.io/nvidia/nvcf/admin-token-issuer-proxy:1.1.0 is publicly available.
Internal release wiring is tracked in nvcf/nvcf-internal!187; that lane stages
to nvstaging, while final catalog publication remains gated by the
self-managed-stack nSpect/nvpublish release. Once published, this branch will
update the default image tag from 1.0.2 to 1.1.0.

No third-party dependencies are added.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}