Why /healthy returned 200 with OPA dead                                           
                                                                                 
  The /healthy endpoint has two code paths:                                         
                                                                                  
  async def healthy():                                                              
      healthy = await self.policy_store.is_healthy()  # checks OPA transaction state
      if healthy:                                                                   
          return 200                                                                
      if self.offline_mode_enabled and await self._is_ready():                      
          return 200  # <-- THIS IS WHY                                             
      return 503
                                                                                    
  Your sidecar has PDP_ENABLE_OFFLINE_MODE=true. When offline mode is enabled, the  
  health check bypasses OPA health and returns 200 as long as the backup config was
  loaded (_is_ready()). The comment in the source even says:                        
                                       
  ▎ "Client would only report unhealthy if server → policy-store transactions       
  failed, but not if server connection gets disconnected."
                                                                                    
  So the flow was:                     
  1. OPA lost policies → is_healthy() returns False
  2. But offline mode is enabled and backup exists → /healthy returns 200 anyway
  3. K8s thinks pod is fine
                                                                                    
  The fix
                                                                                    
  Two options:                                                                      
  
  Option 1: Set OPAL_OPA_HEALTH_CHECK_POLICY_ENABLED=True on the permit-sidecar.    
  This enables a rego policy at system.opal.healthy that checks actual policy/data
  sync state. The /healthy endpoint would then reflect real OPA health.             
                                       
  Option 2: Remove PDP_ENABLE_OFFLINE_MODE=true — but this would mean the PDP       
  reports unhealthy during any transient OPAL disconnection, which might be too
  aggressive.                                                                       
                                       
  Option 3 (best): Keep offline mode but add                                        
  OPAL_OPA_HEALTH_CHECK_POLICY_ENABLED=True, and use /ready or query
  system.opal.ready as the K8s readiness probe instead of /healthy. The ready rule  
  checks that policy bundle synced at least once AND initial data sources loaded —
  which is what you actually want for readiness.