fix: split health endpoint, isolate sequencer, embed lexicons

[rabble]

Summary

• Health endpoint split: The existing /xrpc/_health endpoint now serves as a fast liveness probe (no database check). A new /xrpc/_health/ready endpoint performs the deep readiness check with DB connectivity verification. This allows Kubernetes liveness probes to use the fast endpoint without hitting the database on every check interval.
• Sequencer thread isolation: Move the sequencer polling loop from tokio::spawn (shared worker pool) to a dedicated OS thread with its own single-threaded tokio runtime. This prevents sequencer DB polling from competing with HTTP request handling, avoiding worker thread exhaustion under load.
• ID resolver configuration: Use ServerConfig values (resolver_timeout, cache_state_ttl, cache_max_ttl, plc_url) for the identity resolver instead of reading raw env vars with default None values. This ensures the resolver respects configured timeouts and cache TTLs.
• Compile-time lexicons: Use include_str!() to embed lexicons.toml at compile time instead of fs::read_to_string() at runtime. This removes the fragile requirement to have lexicons.toml in the working directory, which was problematic in containerized deployments.

Test plan

• Verify GET /xrpc/_health returns version without database dependency
• Verify GET /xrpc/_health/ready returns version when DB is connected, 503 when not
• Verify sequencer continues to poll and emit firehose events after the thread isolation change
• Verify subscribe_repos WebSocket consumers still receive events
• Run cargo test -p rsky-pds for the new lexicon loading test
• Deploy in container without lexicons.toml in working directory to verify compile-time embedding works

🤖 Generated with Claude Code