Wait for prod Cloud Run candidate readiness before smoke tests

The gunicorn early-bind entrypoint decouples revision readiness (port
bound) from app readiness (country-package import finished, ~160s), so
gcloud run deploy now returns while the app is still booting. The prod
candidate job ran its smoke tests immediately after deploy and hit the
importing instance, failing with read timeouts; the staging job was
unaffected because it already gates test traffic on health_check.sh.
Add the same readiness wait against the candidate tag URL before the
smoke tests.

Fixes #3731

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anth-volk

.github/workflows/push.yml

@@ -517,6 +517,8 @@ jobs:
           echo "Cloud Run candidate URL: ${url}"
         env:
           CLOUD_RUN_TAG: ${{ steps.cloud_run.outputs.revision_tag }}
+      - name: Wait for Cloud Run candidate health
+        run: bash .github/scripts/health_check.sh "${{ steps.cloud_run_url.outputs.url }}/readiness-check"
       - name: Install Cloud Run smoke test dependencies
         run: pip install pytest httpx
       - name: Run Cloud Run candidate smoke tests

changelog.d/prod-candidate-health-wait.fixed.md

@@ -0,0 +1 @@
+Wait for the production Cloud Run candidate to pass its readiness check before running smoke tests, matching the staging job, so tests no longer race the app import that now happens after the port binds.