fix(kubectl): download kubectl for the runner's arch; wait for rollouts

kubectl-apply and deploy-restart always downloaded the linux/amd64
kubectl binary, which only worked on arm64 runners because the runner
images ship kubectl preinstalled. Detect the arch via uname -m, and use
curl -f so a bad version fails instead of saving an error page.

deploy-restart now waits for `kubectl rollout status` by default (new
`wait` / `timeout` inputs, default true / 300s) and prints deployment,
pod and event diagnostics when the rollout does not complete.

The self-test pins kube_version to force the download path and sets a
rollout timeout. README and AGENTS.md document the new inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -38,13 +38,15 @@ Same remote SSH Buildx setup as `build-and-push`, but only **builds** the multi-
 
 ### `deploy-restart` (`deploy-restart/action.yaml`)
 
-Validates `KUBE_CONFIG`, installs kubectl, and performs `rollout restart` of a Kubernetes Deployment.
+Validates `KUBE_CONFIG`, installs kubectl (matching the runner's arch), performs `rollout restart` of a Kubernetes Deployment, and by default waits for `rollout status` — failing the step with pod/event diagnostics if the rollout doesn't complete.
 
 **Inputs:**
 - `kube_config` (required) — full kubeconfig YAML (use secrets)
 - `deployment_name` (required) — Deployment name to restart
 - `namespace` (default `default`) — Kubernetes namespace
 - `kube_version` (default `stable`) — kubectl version to download
+- `wait` (default `true`) — wait for the rollout to complete; set `false` to fire-and-forget
+- `timeout` (default `300s`) — max rollout wait (kubectl duration)
 
 ### `kubectl-apply` (`kubectl-apply/action.yaml`)