fix(kubectl): download kubectl for the runner's arch; wait for rollouts

kubectl-apply and deploy-restart always downloaded the linux/amd64
kubectl binary, which only worked on arm64 runners because the runner
images ship kubectl preinstalled. Detect the arch via uname -m, and use
curl -f so a bad version fails instead of saving an error page.

deploy-restart now waits for `kubectl rollout status` by default (new
`wait` / `timeout` inputs, default true / 300s) and prints deployment,
pod and event diagnostics when the rollout does not complete.

The self-test pins kube_version to force the download path and sets a
rollout timeout. README and AGENTS.md document the new inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/test-build.yaml

@@ -164,6 +164,9 @@ jobs:
           kube_config: ${{ secrets.KUBE_CONFIG }}
           manifest: tests/manifests/test-deployment.yaml
           namespace: ${{ env.TEST_NAMESPACE }}
+          # Pin a version different from the runner image's preinstalled
+          # kubectl so the download path (arch detection) is exercised.
+          kube_version: v1.31.0
 
       - name: Restart test deployment
         uses: https://git.ivanch.me/ivanch/pipeline-actions/deploy-restart@main
@@ -171,6 +174,7 @@ jobs:
           kube_config: ${{ secrets.KUBE_CONFIG }}
           deployment_name: pipeline-actions-test
           namespace: ${{ env.TEST_NAMESPACE }}
+          timeout: 120s
 
       - name: Verify deployment rollout status
         shell: bash