An ingress rewrite rule strips the trailing slash from the websocket path and only interactive sessions fail while health checks stay green

The service looks healthy through normal probes, yet upgraded connections hit a subtly different path contract.