fix(kubectl): download kubectl for the runner's arch; wait for rollouts

kubectl-apply and deploy-restart always downloaded the linux/amd64
kubectl binary, which only worked on arm64 runners because the runner
images ship kubectl preinstalled. Detect the arch via uname -m, and use
curl -f so a bad version fails instead of saving an error page.

deploy-restart now waits for `kubectl rollout status` by default (new
`wait` / `timeout` inputs, default true / 300s) and prints deployment,
pod and event diagnostics when the rollout does not complete.

The self-test pins kube_version to force the download path and sets a
rollout timeout. README and AGENTS.md document the new inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubectl-apply/action.yaml

@@ -89,9 +89,18 @@ runs:
           KUBE_VER="${KUBE_VERSION}"
         fi
 
-        # 4. Download kubectl
-        echo "Downloading kubectl version ${KUBE_VER}..."
-        curl -LO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/amd64/kubectl"
+        # 4. Detect runner architecture and download the matching kubectl
+        case "$(uname -m)" in
+          x86_64|amd64)   KUBE_ARCH=amd64 ;;
+          aarch64|arm64)  KUBE_ARCH=arm64 ;;
+          armv7l|armv7)   KUBE_ARCH=arm ;;
+          *)
+            echo "::error::Unsupported runner architecture: $(uname -m)"
+            exit 1
+            ;;
+        esac
+        echo "Downloading kubectl version ${KUBE_VER} (linux/${KUBE_ARCH})..."
+        curl -fLO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/${KUBE_ARCH}/kubectl"
 
         # 5. Install kubectl to a writable directory
         if [ -w "/usr/local/bin" ]; then