fix(kubectl): download kubectl for the runner's arch; wait for rollouts

kubectl-apply and deploy-restart always downloaded the linux/amd64
kubectl binary, which only worked on arm64 runners because the runner
images ship kubectl preinstalled. Detect the arch via uname -m, and use
curl -f so a bad version fails instead of saving an error page.

deploy-restart now waits for `kubectl rollout status` by default (new
`wait` / `timeout` inputs, default true / 300s) and prints deployment,
pod and event diagnostics when the rollout does not complete.

The self-test pins kube_version to force the download path and sets a
rollout timeout. README and AGENTS.md document the new inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy-restart/action.yaml

@@ -16,6 +16,14 @@ inputs:
     description: Kubernetes version to download (stable, or a specific version like v1.31.0)
     required: false
     default: stable
+  wait:
+    description: Wait for the rollout to finish and fail the step if it does not become ready ("true"/"false")
+    required: false
+    default: "true"
+  timeout:
+    description: How long to wait for the rollout when wait is enabled (kubectl duration, e.g. 300s, 5m)
+    required: false
+    default: 300s
 
 runs:
   using: composite
@@ -80,9 +88,18 @@ runs:
           KUBE_VER="${KUBE_VERSION}"
         fi
 
-        # 4. Download kubectl
-        echo "Downloading kubectl version ${KUBE_VER}..."
-        curl -LO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/amd64/kubectl"
+        # 4. Detect runner architecture and download the matching kubectl
+        case "$(uname -m)" in
+          x86_64|amd64)   KUBE_ARCH=amd64 ;;
+          aarch64|arm64)  KUBE_ARCH=arm64 ;;
+          armv7l|armv7)   KUBE_ARCH=arm ;;
+          *)
+            echo "::error::Unsupported runner architecture: $(uname -m)"
+            exit 1
+            ;;
+        esac
+        echo "Downloading kubectl version ${KUBE_VER} (linux/${KUBE_ARCH})..."
+        curl -fLO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/${KUBE_ARCH}/kubectl"
 
         # 5. Install kubectl to a writable directory
         if [ -w "/usr/local/bin" ]; then
@@ -117,3 +134,37 @@ runs:
       run: |
         kubectl --kubeconfig=kubeconfig.yaml rollout restart \
           deployment "${DEPLOYMENT_NAME}" -n "${NAMESPACE}"
+
+    - name: Wait for rollout to complete
+      shell: bash
+      env:
+        DEPLOYMENT_NAME: ${{ inputs.deployment_name }}
+        NAMESPACE: ${{ inputs.namespace }}
+        WAIT: ${{ inputs.wait }}
+        TIMEOUT: ${{ inputs.timeout }}
+      run: |
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        WAIT=$(printf '%s' "${WAIT}" | tr -d '\r' | tr '[:upper:]' '[:lower:]')
+        TIMEOUT=$(printf '%s' "${TIMEOUT}" | tr -d '\r')
+
+        if [ "${WAIT}" != "true" ]; then
+          echo "wait=${WAIT}; not waiting for rollout."
+          exit 0
+        fi
+
+        echo "Waiting up to ${TIMEOUT} for deployment/${DEPLOYMENT_NAME} in ${NAMESPACE}..."
+        if kubectl --kubeconfig=kubeconfig.yaml rollout status \
+             deployment "${DEPLOYMENT_NAME}" -n "${NAMESPACE}" --timeout="${TIMEOUT}"; then
+          echo "Rollout of deployment/${DEPLOYMENT_NAME} completed."
+          exit 0
+        fi
+
+        echo "::error::Rollout of deployment/${DEPLOYMENT_NAME} did not complete within ${TIMEOUT}."
+        echo "== deployment =="
+        kubectl --kubeconfig=kubeconfig.yaml describe deployment "${DEPLOYMENT_NAME}" -n "${NAMESPACE}" | tail -n 30 || true
+        echo "== pods =="
+        kubectl --kubeconfig=kubeconfig.yaml get pods -n "${NAMESPACE}" -o wide || true
+        echo "== recent events =="
+        kubectl --kubeconfig=kubeconfig.yaml get events -n "${NAMESPACE}" \
+          --sort-by=.lastTimestamp | tail -n 20 || true
+        exit 1