feat: make reboot — diagnose + auto-heal the lab after a host reboot - #17

A host reboot restarts the k3d node container and breaks several things that a
plain `kubectl get pods` won't explain, and they compound:
- flannel /run/flannel/subnet.env wiped (tmpfs) -> pod sandbox failures
- host.k3d.internal stripped from CoreDNS -> ESO can't reach floci
- webapp image drops out of node containerd -> ImagePullBackOff (node can't pull
  the floci ECR ref: inside the node it resolves to the node's own loopback)
- floci down / lost un-flushed data

New:
- scripts/recover.sh (make reboot): checks and fixes each of the above in order,
  idempotent, never touches Terraform state / floci secrets / infra roots.
- scripts/ensure-webapp-image.sh: snapshotter-safe image loader. `k3d image
  import` silently no-ops on Docker's containerd-snapshotter store (default on
  recent Docker/Ubuntu) — docker save emits an OCI layout the importer rejects
  ("content digest not found") but reports success. This verifies the image
  landed and falls back to pulling the identical upstream image into the node's
  containerd + retagging. Used by both `make reboot` and the deploy.
- terraform/cluster/webapp.tf: image import now calls ensure-webapp-image.sh, so
  a fresh `make deploy` works regardless of Docker's storage driver.
- README: "After a reboot" section + the image-loading note.

Validated end-to-end on a live cluster: healthy checks pass, host-fix reapplied,
ESO re-synced (SecretSynced), webapp 1/1, app HTTP 200. Security gate PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>