ops: fix internal production host probes

deploy/run-production-deploy.sh

@@ -213,6 +213,7 @@ verify_container_image web "$WEB_IMAGE"
   -e PRODUCTION_ADMIN_URL="$PRODUCTION_ADMIN_URL" \
   -e VERIFICATION_MODE="$VERIFICATION_MODE" \
   web node --input-type=module <<'NODE'
+import http from "node:http";
 import { Pool } from "pg";
 
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -241,9 +242,30 @@ for (const [role, key] of [
 
 const internal = process.env.VERIFICATION_MODE === "internal";
 const request = (origin, path, options = {}) => {
-  const target = internal ? `http://127.0.0.1:3000${path}` : `${origin}${path}`;
-  const headers = internal ? { ...options.headers, host: new URL(origin).host } : options.headers;
-  return fetch(target, { ...options, headers });
+  if (!internal) return fetch(`${origin}${path}`, options);
+  return new Promise((resolve, reject) => {
+    const request = http.request({
+      host: "127.0.0.1",
+      port: 3000,
+      path,
+      method: options.method ?? "GET",
+      headers: { ...options.headers, Host: new URL(origin).host },
+    }, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("end", () => {
+        const status = response.statusCode ?? 0;
+        resolve({
+          status,
+          ok: status >= 200 && status < 300,
+          headers: { get: (name) => response.headers[name.toLowerCase()] ?? null },
+          json: async () => JSON.parse(Buffer.concat(chunks).toString("utf8")),
+        });
+      });
+    });
+    request.on("error", reject);
+    request.end();
+  });
 };
 let observed = {};
 for (let attempt = 1; attempt <= 12; attempt += 1) {

frontend/tests/staging-backend-workflows.test.ts

@@ -988,6 +988,8 @@ test("production runner validates state and migrations before switching exact im
   assert.match(runner, /pending migrations: run Migrate Production Database/);
   assert.doesNotMatch(runner, /--profile migration run --rm migrator/);
   assert.match(runner, /if \[ "\$VERIFICATION_MODE" = "public" \]/);
+  assert.match(runner, /import http from "node:http"/);
+  assert.match(runner, /http\.request\(\{[\s\S]*Host: new URL\(origin\)\.host/);
   assert.match(runner, /up -d --no-build api web/);
   assert.match(runner, /up -d --no-build --force-recreate --no-deps caddy/);
   assert.match(runner, /\["identity", "IDENTITY_DATABASE_URL"\]/);