Why is a single-replica 'critical' service a high-availability anti-pattern even if it has a restart policy?

A restart policy only handles the case where the process crashes and the same host is available to restart it — it does not protect against the host itself failing, network partition to that host, or the restart taking long enough (cold start, cache warm-up, dependency timeouts) to cause real user-facing downtime. True HA requires multiple replicas across independent failure domains (hosts, ideally availability zones) behind a load balancer that can route around a failed instance immediately, with no restart-induced gap in service.