fix: provide standalone kill in Arc runtime images

[littlehand26]

Summary

• Install procps in both release runtimes so Kubernetes can directly exec kill; Bash's builtin does not satisfy that interface.
• Test kill as the container entrypoint and through env, rather than accidentally exercising only the shell builtin.
• Check standalone startup/stop utilities and verify non-root maintenance markers at /tmp/done.done and /tmp/prune.done, without pre-creating completion files in the image.
• Remove the broken Waterloo security mirror URI that blocked amd64 builds; retain the other sources and Debian signature verification.

No Rust, Cargo, node entrypoint, UID/GID, or public RPC execution changes.

Validation

• bash -n .github/scripts/test-runtime-image.sh and git diff --check: pass.
• Isolated amd64 runtime tests for EL and CL: pass (default UID/GID 999; direct kill; signal delivery; shell/coreutils; binary loading).
• Actual maintenance-prefix tests: EL/CL × backup/prune markers and direct kill -TERM 1 to PID 1, all four exit 143.
• Whole-volume bootnode fixture: removes only the discovery key and preserves a sibling file.

Local runtime-only fixtures reuse existing application binaries; they are not a rebuild of this commit. Initial validation used the official Debian source after the Waterloo security mirror returned an index size/hash mismatch. The follow-up source fix was then tested with the exact repository source configuration: runtime-base build passed, and UID999 directly executed /usr/bin/kill -l TERM successfully. Full commit-bound amd64/arm64 images remain subject to CI.

Initial CI (35305673132): both arm64 component builds and runtime checks passed; both amd64 builds failed in the existing chef apt-get update step with the same Waterloo index mismatch (339172 bytes received versus 339152 declared). Commit ee213fbf removes that security URI; replacement CI 35307110479 is running/queued, so final candidate publication is not yet verified.

Deployment dependency

This image change alone does not repair backup orchestration. SRE must update both maintenance marker writers/readers, wait for EL and CL to stop, and mount the seed data volume in its initContainer. The current deployment files are directly applied resources rather than Arc files tracked in the manifest repository; scoped patches and failure-path tests are retained locally for SRE review. No production changes, release, or merge performed here.

Current user scope is images only. The prepared deployment changes are paused and are not part of this PR.