fix(kubectl): download kubectl for the runner's arch; wait for rollouts

kubectl-apply and deploy-restart always downloaded the linux/amd64
kubectl binary, which only worked on arm64 runners because the runner
images ship kubectl preinstalled. Detect the arch via uname -m, and use
curl -f so a bad version fails instead of saving an error page.

deploy-restart now waits for `kubectl rollout status` by default (new
`wait` / `timeout` inputs, default true / 300s) and prints deployment,
pod and event diagnostics when the rollout does not complete.

The self-test pins kube_version to force the download path and sets a
rollout timeout. README and AGENTS.md document the new inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -92,7 +92,7 @@ jobs:
 
 ### `deploy-restart`
 
-Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a Kubernetes Deployment.
+Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a Kubernetes Deployment. By default it then waits for the rollout to finish (`kubectl rollout status`) and fails the step — printing the deployment, pods and recent events — if the new pods don't become ready in time.
 
 | Input | Required | Default | Description |
 |---|---|---|---|
@@ -100,6 +100,8 @@ Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a
 | `deployment_name` | ✅ | — | Deployment name to restart |
 | `namespace` | ❌ | `default` | Kubernetes namespace |
 | `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) |
+| `wait` | ❌ | `true` | Wait for the rollout to complete and fail if it doesn't |
+| `timeout` | ❌ | `300s` | Max time to wait for the rollout (kubectl duration, e.g. `5m`) |
 
 ### `kubectl-apply`
 
@@ -147,6 +149,8 @@ jobs:
           # optional:
           # namespace: default
           # kube_version: stable
+          # wait: "true"     # wait for rollout status
+          # timeout: 300s
 ```
 
 ---