Add tcpSocket as a container readiness probe kind

## Summary

Container readiness in ActorTemplate accepts only an HTTP GET probe. `ContainerReadyz.httpGet` is a required field with no alternative, so a container that does not serve HTTP cannot declare readiness at all.

This asks for one additional kind, `tcpSocket`, and for the probe kind to become a union so further kinds can be added easily later.

## Motivation

We run a two container actor. One container serves HTTP and can be probed today. The other serves only gRPC on its own port and has no HTTP endpoint, so it cannot be probed at all.

In a POC, to get an honest readiness signal we had to add a third container to the actor, a proxy that aggregates both upstreams behind a single HTTP endpoint purely so substrate has something to GET.

The alternative is worse: declare no readiness on the gRPC container and let the actor be advertised as ready before that container can serve.

This is not specific to our workload. Any gRPC only, or plain TCP, server has the same problem.

## Proposal

Follow the Kubernetes `ProbeHandler` shape:

- add `tcpSocket` with a `port`
- make `httpGet` optional and add a CEL rule requiring exactly one probe kind to be set

Making the kind a union is the part that matters beyond this request. Once it exists, adding `grpc` or `exec` later is a field rather than a redesign, which is what #316 anticipated.