Security and reliability improvements

- Add SHA256 checksum verification for yq and oc downloads to prevent supply chain attacks
- Pin busybox init container to version 1.36 for consistency
- Fix gitconfig symlink to work unconditionally (survives file creation after boot)
- Document kubeconfig secret prerequisite with correct breakglass config path

Security: Protects against compromised mirrors and MITM attacks during image build
Reliability: Ensures reproducible builds and proper git config persistence

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

manifests/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         runAsNonRoot: true
       initContainers:
         - name: setup-ssh
-          image: busybox:latest
+          image: busybox:1.36
           command:
             - sh
             - -c