Readiness probe — gates on the database plus the startup readiness latch (≥1 cluster seen). Ready iff the DB is reachable AND startup has latched; a later cluster outage does NOT 503 (lenient) — sandbox-start fails fast on its own, so cluster-independent endpoints keep serving. Ongoing cluster health lives in metrics.