fix(k8s): honor health_check.enabled in the deployment template

[fedemaleh]

What

health_check.enabled has been in the scope schema since the first commit and no template ever read it — turning the health check off hid the other health-check fields in the form and changed nothing else. The deployment template now drops the liveness, readiness and startup probes from all four containers (main traffic-manager sidecar, HTTP and GRPC additional-port sidecars, application) when the flag is explicitly false. azure and azure-aro reuse this template, so they get the fix too.

Why we want it

An application that does not serve the health endpoint is killed in a restart loop while the UI says its health check is off.

The criterion behind the fix

Probes are removed only when the key is present and false. Scopes created before the flag existed have no enabled key at all — the schema default applies at creation, not retroactively — so a plain truthiness check would have stripped the probes from every legacy scope on its next deploy. The render for enabled: true, for a missing key, and for type: TCP is byte-identical to beta.

Deliberately not done: the ALB healthcheck-* annotations in service.yaml.tpl are untouched. AWS always health-checks a target group, so that stays the backstop for ALB-fronted traffic — and the limitation is that such a target can remain unhealthy. It needs its own decision.

Covered by k8s/deployment/tests/health_check_disabled.bats.