fix: drop flaky ntfy echo check; assert container + publish 200

infra/doorbell-listener/scripts/kuma-heartbeat.sh

@@ -19,19 +19,14 @@ else
     # 2. ntfy.sh round-trip: publish a unique canary, read it back.
     #    Proves the ntfy.sh leg we depend on (publish + subscribe) works,
     #    without us owning the service.
-    marker="canary-$(date +%s)-$$"
+    # Publish a canary. A 200 proves ntfy.sh (which we don't own) is
+    # reachable and accepting our messages. We deliberately do NOT read it
+    # back: ntfy.sh's cache/echo is unreliable for an always-on probe and
+    # caused false "down" alerts. The subscribe/deliver leg is continuously
+    # exercised by the production listener consuming real alerts.
     url="https://ntfy.sh/${CANARY_TOPIC}"
-    if ! curl -fsS -m 10 -o /dev/null -X POST "$url" -H "id: $marker" -d "$marker" 2>/dev/null; then
+    if ! curl -fsS -m 10 -o /dev/null -X POST "$url" -d "canary-$(date +%s)" 2>/dev/null; then
         reason="${reason}ntfy_publish_failed"
-    else
-        # Read back with poll+since, bounded by --max-time so the ntfy.sh
-        # stream doesn't hang the probe (plain /json keeps the connection open).
-        tmp=$(mktemp)
-        curl -fsS --max-time 5 "$url/json?poll=1&since=$(($(date +%s)-5))" -o "$tmp" 2>/dev/null
-        if ! grep -qF "$marker" "$tmp"; then
-            reason="${reason}ntfy_echo_missing"
-        fi
-        rm -f "$tmp"
     fi
 fi