fix: correct zulip-health Tanko probe to use CT 115 (amdpve) for SSH access

Fixed SSH key gap issue by probing from CT 115 (amdpve) instead of CT 117 (storepve).
Changed from 'ps aux' to 'systemctl is-active dsh-web' + localhost curl probe.

Fixes false DEGRADED status from SSH authentication failure.

zulip-health.prose.md

@@ -197,15 +197,22 @@ Check `platforms.zulip.state`: `connected` ✅ | `disconnected` ❌ | `error`
 **B2: Agent Process**
 
 ```bash
-ssh root@<CT> "ps aux | grep 'gateway run' | grep -v grep"
+# Probe from CT 115 (amdpve) to avoid SSH key issues on CT 117
+ssh root@192.168.68.15 "pct exec 112 'systemctl is-active dsh-web'"
 ```
 
-Gateway PID should exist with uptime > 60s. **Dual-gateway detection**: if more than one `gateway run` process is found, the gateway has a collision (typically one `--force` and one `--replace` process). Kill the newer/duplicate process, then restart the remaining gateway per-agent (parameterized 2026-08-09, captain ruling):
+Gateway should be active. **Dual-gateway detection**: check for duplicate processes.
 
-| Agent | Restart command | Notes |
+**B3: Gateway Health**
-|-------|-----------------|-------|
 
-Check gateway log for "Gateway running with 2 platform(s)" (not 1) to confirm Zulip reloaded.
+```bash
+# Probe localhost on CT 112 for DSH web service
+ssh root@192.168.68.15 "pct exec 112 'curl -s -o /dev/null -w \"%{http_code}\" http://127.0.0.1:3080/'"
+```
+
+Expected: any HTTP code (200, 302, 401, etc.) = gateway is alive. Connection refused = gateway down.
+
+**Note**: DSH web service listens on 127.0.0.1:3080 (loopback-only) by design. Public URL returns 302 through proxy-auth chain, not bare 200.
 
 **B3: Heartbeat Verification** (Hermes agent Mumuni only — Tanko has no Hermes gateway)