fix(devops): fix OpenBao healthcheck URL truncation with CMD-SHELL

The CMD exec form drops everything after & in the healthcheck URL,
causing uninitcode=200 and sealedcode=200 params to be lost. Without
them, OpenBao returns 501 when uninitialized, healthcheck fails, and
Swarm kills the container before the init sidecar can reach it.

Switch to CMD-SHELL with single-quoted URL to preserve query params.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.openbao.yml

@@ -27,11 +27,8 @@ services:
     healthcheck:
       test:
         [
-          "CMD",
-          "wget",
-          "--spider",
-          "--quiet",
-          "http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200",
+          "CMD-SHELL",
+          "wget --spider --quiet 'http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200'",
         ]
       interval: 10s
       timeout: 5s