Harden scratch setup third-party readiness probes

scripts/setup.ps1

@@ -114,6 +114,34 @@ function Get-RunningContainerByService([string]$serviceName) {
     return $null
 }
 
+function Get-ServiceHttpProbeUrl([string]$serviceName, [int]$containerPort, [string]$path = '/') {
+    $containerName = Get-RunningContainerByService $serviceName
+    if (-not $containerName) {
+        return $null
+    }
+
+    $portMapping = docker port $containerName "${containerPort}/tcp" 2>$null | Select-Object -First 1
+    if (-not $portMapping) {
+        return $null
+    }
+
+    $portMapping = $portMapping.Trim()
+    if ($portMapping -notmatch '^(?<host>.+):(?<port>\d+)$') {
+        return $null
+    }
+
+    $probeHost = $Matches.host
+    if ($probeHost -eq '0.0.0.0' -or $probeHost -eq '::') {
+        $probeHost = '127.0.0.1'
+    }
+
+    if (-not $path.StartsWith('/')) {
+        $path = "/$path"
+    }
+
+    return "http://${probeHost}:$($Matches.port)$path"
+}
+
 # ─── 1. Check prerequisites ────────────────────────────────────────────────
 
 function Test-Prerequisites {
@@ -439,6 +467,45 @@ function Start-Platform {
     }
 }
 
+function Test-ExpectedHttpStatus([string]$url, [int[]]$allowedStatusCodes, [int]$timeoutSeconds = 5, [int]$attempts = 6, [int]$retryDelaySeconds = 2) {
+    for ($attempt = 1; $attempt -le $attempts; $attempt++) {
+        $statusCode = $null
+
+        try {
+            $request = [System.Net.WebRequest]::Create($url)
+            $request.Method = 'GET'
+            $request.Timeout = $timeoutSeconds * 1000
+            $response = [System.Net.HttpWebResponse]$request.GetResponse()
+
+            try {
+                $statusCode = [int]$response.StatusCode
+            } finally {
+                $response.Dispose()
+            }
+        } catch [System.Net.WebException] {
+            $webResponse = $_.Exception.Response -as [System.Net.HttpWebResponse]
+            if ($null -ne $webResponse) {
+                try {
+                    $statusCode = [int]$webResponse.StatusCode
+                } finally {
+                    $webResponse.Dispose()
+                }
+            }
+        } catch {
+        }
+
+        if ($null -ne $statusCode -and $allowedStatusCodes -contains $statusCode) {
+            return $statusCode
+        }
+
+        if ($attempt -lt $attempts) {
+            Start-Sleep -Seconds $retryDelaySeconds
+        }
+    }
+
+    return $null
+}
+
 # ─── 8. Smoke test ─────────────────────────────────────────────────────────
 
 function Test-Smoke {
@@ -474,6 +541,24 @@ function Test-Smoke {
         $hasBlockingFailures = $true
     }
 
+    $rustFsUrl = Get-ServiceHttpProbeUrl 'rustfs' 8333 '/'
+    $rustFsStatus = if ($rustFsUrl) { Test-ExpectedHttpStatus $rustFsUrl @(200, 403) } else { $null }
+    if ($null -ne $rustFsStatus) {
+        Write-Ok "RustFS S3 endpoint (HTTP $rustFsStatus)"
+    } else {
+        Write-Fail 'RustFS S3 endpoint did not respond with an expected status (wanted 200/403)'
+        $hasBlockingFailures = $true
+    }
+
+    $registryUrl = Get-ServiceHttpProbeUrl 'registry' 5000 '/v2/'
+    $registryStatus = if ($registryUrl) { Test-ExpectedHttpStatus $registryUrl @(200, 401) } else { $null }
+    if ($null -ne $registryStatus) {
+        Write-Ok "Zot registry endpoint (HTTP $registryStatus)"
+    } else {
+        Write-Fail 'Zot registry endpoint did not respond with an expected status (wanted 200/401)'
+        $hasBlockingFailures = $true
+    }
+
     # Platform container health summary
     Write-Step 'Container health summary'
     Push-Location $ComposeDir