Security and reliability improvements

- Add SHA256 checksum verification for yq and oc downloads to prevent supply chain attacks
- Pin busybox init container to version 1.36 for consistency
- Fix gitconfig symlink to work unconditionally (survives file creation after boot)
- Document kubeconfig secret prerequisite with correct breakglass config path

Security: Protects against compromised mirrors and MITM attacks during image build
Reliability: Ensures reproducible builds and proper git config persistence

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

README.md

@@ -19,6 +19,18 @@ This container provides a stable, tool-rich environment for the AI agent to:
 - **Kubernetes:** OpenShift CLI (oc)
 - **Search:** ripgrep (fast grep alternative)
 
+## Prerequisites
+
+Before deploying, create the kubeconfig secret to give the container kubectl/oc access:
+
+```bash
+kubectl create secret generic kube \
+  --from-file=config=$HOME/.kube/breakglass-system-admin.kubeconfig \
+  -n clawdbox
+```
+
+**Note:** This kubeconfig is mounted at `/home/claw/.kube/config` inside the container.
+
 ## Deployment (OpenShift / K8s)
 
 1. **Build Image:**