fix(ci): kyverno CLI arch x86_64 in install-tools; wait for dind certs

- install-tools.sh: the kyverno CLI release tarball is named _linux_x86_64, not
  _linux_amd64 (mirrors infra/devcontainer/Containerfile). The gate job's kyverno
  install 404'd on amd64; map amd64 -> x86_64 for kyverno only.
- act-runner: wait for /certs/client/ca.pem (published by the DinD sidecar) before
  exec-ing the entrypoint, eliminating the startup crash-loop race.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/scripts/install-tools.sh

@@ -24,7 +24,11 @@ install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${
 install_kyverno() {
   have kyverno && return 0
   log "kyverno CLI ${KYVERNO_VERSION}"
-  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
+  # Arch strings differ per tool: the kyverno CLI tarball uses x86_64 (uname -m style),
+  # NOT amd64 — map it here (mirrors infra/devcontainer/Containerfile). chainsaw/kubectl
+  # below use the amd64/arm64 form, so only kyverno needs this.
+  local karch="$arch"; case "$arch" in amd64) karch=x86_64 ;; esac
+  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${karch}.tar.gz"
   curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
 }