feat: bump KubeSolo to v1.1.5 + cross-arch CI workflow

Phase 4 of v0.3 — KubeSolo version bump and CI gating.

KubeSolo v1.1.0 → v1.1.5 brings:
- New flag --disable-ipv6 (v1.1.5)
- New flag --db-wal-repair (v1.1.5) — important for power-loss resilience
  on edge appliances; surfaced as kubesolo.db-wal-repair in cloud-init
- New flag --full (v1.1.4) — disables edge-optimised k8s overrides
- Pod egress connectivity fix after reboot (v1.1.4)
- Registry config persistence fix (v1.1.5)
- k8s 1.34.7, CoreDNS 1.14.3, Go 1.26.2

All three new flags wired into cloud-init: config.go fields, kubesolo.go
extra-flag emission, full-config.yaml example.

Supply-chain hygiene:
- Per-arch checksums: KUBESOLO_SHA256_AMD64 and KUBESOLO_SHA256_ARM64 in
  versions.env. Replaces the single shared KUBESOLO_SHA256 that couldn't
  meaningfully verify both binaries at once.
- Checksum now applied to the tarball (the immutable upstream artifact)
  rather than the post-extract binary.

CI:
- New .gitea/workflows/build-arm64.yaml routes the full kernel + rootfs +
  disk-image build to the Odroid arm64-linux runner. Triggers on push to
  main, tags, and manual workflow_dispatch. The boot smoke test is
  continue-on-error because KubeSolo's first-boot image import deadline
  fires under QEMU TCG on the Odroid.

VERSION bumped to 0.3.0-dev. CHANGELOG entry under [0.3.0-dev] captures all
Phase 1-4 work + the known limitations documented in arm64-status.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build/scripts/fetch-components.sh

@@ -60,17 +60,19 @@ if [ "$FETCH_ARCH" = "arm64" ]; then
         BIN_URL="https://github.com/portainer/kubesolo/releases/download/${KUBESOLO_VERSION}/kubesolo-${KUBESOLO_VERSION}-linux-arm64-musl.tar.gz"
         BIN_URL_FALLBACK="https://github.com/portainer/kubesolo/releases/download/${KUBESOLO_VERSION}/kubesolo-${KUBESOLO_VERSION}-linux-arm64.tar.gz"
         TEMP_DIR=$(mktemp -d)
+        TARBALL="$TEMP_DIR/kubesolo.tar.gz"
         echo "    URL: $BIN_URL"
-        if curl -fSL "$BIN_URL" -o "$TEMP_DIR/kubesolo.tar.gz" 2>/dev/null; then
+        if curl -fSL "$BIN_URL" -o "$TARBALL" 2>/dev/null; then
             echo "    Downloaded musl variant (arm64)"
-        elif curl -fSL "$BIN_URL_FALLBACK" -o "$TEMP_DIR/kubesolo.tar.gz" 2>/dev/null; then
+        elif curl -fSL "$BIN_URL_FALLBACK" -o "$TARBALL" 2>/dev/null; then
             echo "    Downloaded glibc variant (arm64 fallback)"
         else
             echo "ERROR: Failed to download KubeSolo ARM64 from GitHub."
             rm -rf "$TEMP_DIR"
             exit 1
         fi
-        tar -xzf "$TEMP_DIR/kubesolo.tar.gz" -C "$TEMP_DIR"
+        verify_checksum "$TARBALL" "${KUBESOLO_SHA256_ARM64:-}" "KubeSolo arm64 tarball"
+        tar -xzf "$TARBALL" -C "$TEMP_DIR"
         FOUND_BIN=$(find "$TEMP_DIR" -name "kubesolo" -type f ! -name "*.tar.gz" | head -1)
         if [ -z "$FOUND_BIN" ]; then
             echo "ERROR: Could not find kubesolo binary in extracted archive"
@@ -131,11 +133,12 @@ else
 
     TEMP_DIR=$(mktemp -d)
     trap 'rm -rf "$TEMP_DIR"' EXIT
+    TARBALL="$TEMP_DIR/kubesolo.tar.gz"
 
     echo "    URL: $BIN_URL"
-    if curl -fSL "$BIN_URL" -o "$TEMP_DIR/kubesolo.tar.gz" 2>/dev/null; then
+    if curl -fSL "$BIN_URL" -o "$TARBALL" 2>/dev/null; then
         echo "    Downloaded musl variant"
-    elif curl -fSL "$BIN_URL_FALLBACK" -o "$TEMP_DIR/kubesolo.tar.gz" 2>/dev/null; then
+    elif curl -fSL "$BIN_URL_FALLBACK" -o "$TARBALL" 2>/dev/null; then
         echo "    Downloaded glibc variant (fallback)"
     else
         echo "ERROR: Failed to download KubeSolo from GitHub."
@@ -148,9 +151,10 @@ else
         echo "    3. Re-run: make rootfs"
         exit 1
     fi
+    verify_checksum "$TARBALL" "${KUBESOLO_SHA256_AMD64:-}" "KubeSolo amd64 tarball"
 
     # Extract binary from tarball
-    tar -xzf "$TEMP_DIR/kubesolo.tar.gz" -C "$TEMP_DIR"
+    tar -xzf "$TARBALL" -C "$TEMP_DIR"
 
     # Find the kubesolo binary in extracted contents
     FOUND_BIN=$(find "$TEMP_DIR" -name "kubesolo" -type f ! -name "*.tar.gz" | head -1)
@@ -168,7 +172,6 @@ else
     rm -rf "$TEMP_DIR"
 
     echo "==> KubeSolo binary: $KUBESOLO_BIN ($(du -h "$KUBESOLO_BIN" | cut -f1))"
-    verify_checksum "$KUBESOLO_BIN" "$KUBESOLO_SHA256" "KubeSolo binary"
 fi
 
 # --- Tiny Core kernel module extensions (netfilter, iptables) ---