fix(devops): fix OpenBao healthcheck URL truncation with CMD-SHELL

The CMD exec form drops everything after & in the healthcheck URL,
causing uninitcode=200 and sealedcode=200 params to be lost. Without
them, OpenBao returns 501 when uninitialized, healthcheck fails, and
Swarm kills the container before the init sidecar can reach it.

Switch to CMD-SHELL with single-quoted URL to preserve query params.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.openbao.yml

@@ -27,11 +27,8 @@ services:
     healthcheck:
       test:
         [
-          "CMD",
-          "wget",
-          "--spider",
-          "--quiet",
-          "http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200",
+          "CMD-SHELL",
+          "wget --spider --quiet 'http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200'",
         ]
       interval: 10s
       timeout: 5s

docker-compose.portainer.yml

@@ -40,11 +40,10 @@ services:
       - IPC_LOCK
     healthcheck:
       test:
-        - CMD
-        - wget
-        - --spider
-        - --quiet
-        - http://localhost:8200/v1/sys/health?standbyok=true
+        [
+          "CMD-SHELL",
+          "wget --spider --quiet 'http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200'",
+        ]
       interval: 10s
       timeout: 5s
       retries: 5

docker-compose.swarm.yml

@@ -97,11 +97,8 @@ services:
     healthcheck:
       test:
         [
-          "CMD",
-          "wget",
-          "--spider",
-          "--quiet",
-          "http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200",
+          "CMD-SHELL",
+          "wget --spider --quiet 'http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200'",
         ]
       interval: 10s
       timeout: 5s

docker/docker-compose.yml

@@ -89,11 +89,8 @@ services:
     healthcheck:
       test:
         [
-          "CMD",
-          "wget",
-          "--spider",
-          "--quiet",
-          "http://127.0.0.1:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200",
+          "CMD-SHELL",
+          "wget --spider --quiet 'http://127.0.0.1:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200'",
         ]
       interval: 10s
       timeout: 5s