- Add SHA256 checksum verification for yq and oc downloads to prevent supply chain attacks
- Pin busybox init container to version 1.36 for consistency
- Fix gitconfig symlink to work unconditionally (survives file creation after boot)
- Document kubeconfig secret prerequisite with correct breakglass config path
Security: Protects against compromised mirrors and MITM attacks during image build
Reliability: Ensures reproducible builds and proper git config persistence
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Conan Scott
c909668246