Fix plugin updates.

internal/authproxy/server.go

@@ -255,9 +255,19 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 		<p><a href="/">Sign in again</a></p>`)
 }
 
+// handleHealthz is both the container health probe and the plugin's way of
+// asking the running binary what it is doing. It reports the per-app config
+// directory because nothing outside the process can: a container recreated
+// from a stale image has the bind mount and GOOGLE_AUTH_APP_CONFIG_DIR in its
+// environment while running a binary from before per-app lists existed, which
+// ignores both and quietly falls back to the global lists. That build answers
+// this endpoint with a bare "ok" and no directory, which is what tells the two
+// apart.
 func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	fmt.Fprint(w, "ok")
+	fmt.Fprintf(w, `{"ok":true,"app_config_dir":%q}`, s.cfg.AppConfigDir)
 }
 
 // handleStatus is a small human-readable page for debugging.