feat(health): add TCP connectivity probe

internal/health/health.go

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+
+// Package health performs post-apply connectivity checks.
+package health
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+)
+
+// DialTCP attempts a TCP connection to addr within timeout.
+func DialTCP(ctx context.Context, addr string, timeout time.Duration) error {
+	d := net.Dialer{Timeout: timeout}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return fmt.Errorf("connect %s: %w", addr, err)
+	}
+	return conn.Close()
+}