Add optional healthcheck heartbeat

The check is silent by design on a healthy host, so an absent alert is
indistinguishable from a cron that stopped running. Ping HEALTHCHECK_URL
on a clean run and the /fail endpoint when the check alerts or cannot
complete. Empty by default, which disables the pings.

README.md

@@ -44,6 +44,7 @@ ALERT_ON_NO_CERTS=true
 CHECK_SERVED=true
 SERVED_ADDR=127.0.0.1:443
 SERVED_TIMEOUT=10
+HEALTHCHECK_URL=
 ```
 
 ### Served certificate check
@@ -102,3 +103,20 @@ alerting path.
 For jobs where silence is also a failure, pair ntfy with a dead man's switch such
 as Healthchecks. ntfy tells you what the script found; Healthchecks tells you when
 the script did not run at all.
+
+Set `HEALTHCHECK_URL` to enable it. The script pings that URL after a clean run
+and `$HEALTHCHECK_URL/fail` when it alerts or cannot complete the check, so a
+dead cron, a bad chmod or a host that never came back up stops looking like a
+healthy fleet:
+
+```cron
+15 8 * * * HEALTHCHECK_URL=https://hc-ping.com/<uuid> /opt/scripts/check-cert-expiry.sh >>/var/log/cert-expiry-check.log 2>&1
+```
+
+Leaving `HEALTHCHECK_URL` empty disables the pings entirely.
+
+This matters more than it looks for a certificate check specifically. The script
+is designed to stay silent on a healthy host: certbot renews at 30 days and the
+threshold is 25, so a correctly working fleet produces no notifications, ever.
+Without a heartbeat, "no alert" and "the check has not run since March" are the
+same observation.