fix(proxy): expose bounded process liveness for TLS readiness

scripts/release/README.md

@@ -371,3 +371,6 @@ starts no server. Maintenance includes the proxy in start/drain/stop ordering.
 Readiness uses fixed loopback TLS with the supplied certificate as an explicit
 local trust anchor and checks hostname/leaf identity plus the API live response;
 it does not substitute for actual browser CA/HTTPS/security acceptance in the VM.
+The exact `/api/v1/health/live` route permits GET/HEAD for this bounded process
+liveness check. Other health, internal, execution and control routes remain
+outside the public proxy allowlist; liveness does not attest judging readiness.

scripts/release/proxy.py

@@ -121,6 +121,10 @@ http {
         limit_conn per_site 32;
         add_header X-Content-Type-Options nosniff always;
         add_header X-Frame-Options DENY always;
+        location = /api/v1/health/live {
+            limit_except GET { deny all; }
+            PROXY
+        }
         location ~ "UPLOAD" {
             client_max_body_size 64m;
             limit_except PUT { deny all; }