- install-tools.sh: the kyverno CLI release tarball is named _linux_x86_64, not _linux_amd64 (mirrors infra/devcontainer/Containerfile). The gate job's kyverno install 404'd on amd64; map amd64 -> x86_64 for kyverno only. - act-runner: wait for /certs/client/ca.pem (published by the DinD sidecar) before exec-ing the entrypoint, eliminating the startup crash-loop race. Co-Authored-By: Claude Opus 4.8 <[email protected]>