fix: provide standalone kill in Arc runtime images

.github/scripts/test-runtime-image.sh

@@ -4,13 +4,20 @@ set -euo pipefail
 image_ref="${1:?usage: test-runtime-image.sh IMAGE BINARY}"
 binary="${2:?usage: test-runtime-image.sh IMAGE BINARY}"
 
+# Match kubectl exec's direct execution: a Bash builtin is not sufficient.
+docker run --rm --network none --entrypoint kill "$image_ref" -l TERM
+
 # Use the image's default user and isolated temporary files, never a node volume.
 docker run --rm --network none --entrypoint /bin/bash "$image_ref" -euxc '
   [[ "$(id -u)" == 999 && "$(id -g)" == 999 ]]
-  for command in bash sh cat touch tail rm mkdir mktemp; do
-    command -v "$command"
+  for command in bash sh cat touch tail rm mkdir mktemp ls sleep kill; do
+    type -P "$command"
   done
   test -s /etc/ssl/certs/ca-certificates.crt
+  test ! -w /
+  test -w /tmp
+  test ! -e /tmp/prune.done
+  test ! -e /tmp/done.done
   test_dir=$(mktemp -d)
 
   # The init script must delete only the discovery key, including on a rerun.
@@ -30,18 +37,18 @@ docker run --rm --network none --entrypoint /bin/bash "$image_ref" -euxc '
   runmode=$(cat "$test_dir/runmode")
   if [[ X${runmode} != Xnormal ]]; then
     if [[ X${runmode} == Xprune ]]; then
-      touch "$test_dir/prune.done"
+      touch /tmp/prune.done
     fi
-    touch "$test_dir/done.done"
+    touch /tmp/done.done
     tail -f /dev/null &
     child=$!
-    kill -TERM "$child"
+    env kill -TERM "$child"
     status=0
     wait "$child" || status=$?
     [[ "$status" == 143 ]]
   fi
-  test -f "$test_dir/prune.done"
-  test -f "$test_dir/done.done"
+  test -f /tmp/prune.done
+  test -f /tmp/done.done
   /bin/sh -eu -c '\''test "$(cat "$1/runmode")" = prune'\'' sh "$test_dir"
   exec "/usr/local/bin/$1" --version
 ' bash "$binary"

assets/apt/debian.sources

@@ -1,9 +1,9 @@
-# Debian package sources with fallback mirrors for CI reliability
-# Uses DEB822 format with multiple URIs - APT tries them in order until one works
+# Debian package sources and mirrors for CI reliability
+# APT updates each DEB822 URI separately; these are not ordered failover endpoints.
 #
 # Mirror selection rationale:
 # - Primary: deb.debian.org (Fastly CDN, globally distributed)
-# - Fallbacks: University mirrors that also mirror debian-security
+# - Additional mirrors: Waterloo (main) and xTom (main and security)
 #
 # NOTE: Uses HTTPS because HTTP port 80 is blocked by StepSecurity egress policy.
 # NOTE: The suite "bookworm" must match the Debian version in the Dockerfiles.
@@ -17,7 +17,7 @@ Components: main
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 
 Types: deb
-URIs: https://deb.debian.org/debian-security https://mirror.csclub.uwaterloo.ca/debian-security https://mirror.xtom.com/debian-security
+URIs: https://deb.debian.org/debian-security https://mirror.xtom.com/debian-security
 Suites: bookworm-security
 Components: main
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

deployments/Dockerfile.consensus

@@ -93,13 +93,13 @@ FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
 # Bootstrap the HTTPS package sources with the existing certificate bundle.
 COPY --from=chef /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
-# Kubernetes init/runmode scripts require Bash and coreutils; keep Debian 12
-# compatibility with the builder and the previous distroless runtime.
+# Kubernetes init/runmode scripts require Bash, coreutils and standalone kill.
+# Keep Debian 12 compatibility with the builder and previous runtime.
 COPY assets/apt/apt-retry.conf /etc/apt/apt.conf.d/apt-retry.conf
 COPY assets/apt/debian.sources /etc/apt/sources.list.d/debian.sources
 RUN rm -f /etc/apt/sources.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends bash coreutils libstdc++6 && \
+    apt-get install -y --no-install-recommends bash coreutils procps libstdc++6 && \
     rm -rf /var/lib/apt/lists/*
 
 FROM runtime-base AS release-runtime

deployments/Dockerfile.execution

@@ -92,13 +92,13 @@ FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
 
 COPY --from=chef /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
-# Kubernetes init/runmode scripts require Bash and coreutils; keep Debian 12
-# compatibility with the builder and the previous distroless runtime.
+# Kubernetes init/runmode scripts require Bash, coreutils and standalone kill.
+# Keep Debian 12 compatibility with the builder and previous runtime.
 COPY assets/apt/apt-retry.conf /etc/apt/apt.conf.d/apt-retry.conf
 COPY assets/apt/debian.sources /etc/apt/sources.list.d/debian.sources
 RUN rm -f /etc/apt/sources.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends bash coreutils libstdc++6 && \
+    apt-get install -y --no-install-recommends bash coreutils procps libstdc++6 && \
     rm -rf /var/lib/apt/lists/*
 
 FROM runtime-base AS release-runtime