feat: bump KubeSolo to v1.1.5 + cross-arch CI workflow

Phase 4 of v0.3 — KubeSolo version bump and CI gating.

KubeSolo v1.1.0 → v1.1.5 brings:
- New flag --disable-ipv6 (v1.1.5)
- New flag --db-wal-repair (v1.1.5) — important for power-loss resilience
  on edge appliances; surfaced as kubesolo.db-wal-repair in cloud-init
- New flag --full (v1.1.4) — disables edge-optimised k8s overrides
- Pod egress connectivity fix after reboot (v1.1.4)
- Registry config persistence fix (v1.1.5)
- k8s 1.34.7, CoreDNS 1.14.3, Go 1.26.2

All three new flags wired into cloud-init: config.go fields, kubesolo.go
extra-flag emission, full-config.yaml example.

Supply-chain hygiene:
- Per-arch checksums: KUBESOLO_SHA256_AMD64 and KUBESOLO_SHA256_ARM64 in
  versions.env. Replaces the single shared KUBESOLO_SHA256 that couldn't
  meaningfully verify both binaries at once.
- Checksum now applied to the tarball (the immutable upstream artifact)
  rather than the post-extract binary.

CI:
- New .gitea/workflows/build-arm64.yaml routes the full kernel + rootfs +
  disk-image build to the Odroid arm64-linux runner. Triggers on push to
  main, tags, and manual workflow_dispatch. The boot smoke test is
  continue-on-error because KubeSolo's first-boot image import deadline
  fires under QEMU TCG on the Odroid.

VERSION bumped to 0.3.0-dev. CHANGELOG entry under [0.3.0-dev] captures all
Phase 1-4 work + the known limitations documented in arm64-status.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloud-init/config.go

@@ -40,6 +40,14 @@ type KubeSoloConfig struct {
 	PortainerEdgeID        string   `yaml:"portainer-edge-id"`
 	PortainerEdgeKey       string   `yaml:"portainer-edge-key"`
 	PortainerEdgeAsync     bool     `yaml:"portainer-edge-async"`
+	// v1.1.4+: skip edge-optimised overrides, use upstream k8s defaults
+	// (useful for CI and powerful machines, disabled by default).
+	Full bool `yaml:"full"`
+	// v1.1.5+: disable IPv6 in the cluster.
+	DisableIPv6 bool `yaml:"disable-ipv6"`
+	// v1.1.5+: detect SQLite WAL corruption on startup and recover from
+	// unclean shutdowns (e.g. power loss). Recommended ON for edge devices.
+	DBWALRepair bool `yaml:"db-wal-repair"`
 }
 
 // NTPConfig defines NTP settings.

cloud-init/examples/full-config.yaml

@@ -36,5 +36,17 @@ kubesolo:
   portainer-edge-key: "your-edge-key"
   portainer-edge-async: true
 
+  # KubeSolo v1.1.4+: skip the edge-optimised overrides and use upstream
+  # Kubernetes defaults. Useful for CI and high-spec machines. Default off.
+  full: false
+
+  # KubeSolo v1.1.5+: disable IPv6 throughout the cluster. Default off.
+  disable-ipv6: false
+
+  # KubeSolo v1.1.5+: detect SQLite WAL corruption at startup and recover
+  # from unclean shutdowns (e.g. power loss). Recommended ON for edge
+  # appliances that may lose power.
+  db-wal-repair: true
+
   # Arbitrary extra flags passed directly to the KubeSolo binary
   # extra-flags: "--disable traefik --disable servicelb"

cloud-init/kubesolo.go

@@ -70,6 +70,18 @@ func buildExtraFlags(cfg *Config) string {
 		parts = append(parts, "--portainer-edge-async")
 	}
 
+	if cfg.KubeSolo.Full {
+		parts = append(parts, "--full")
+	}
+
+	if cfg.KubeSolo.DisableIPv6 {
+		parts = append(parts, "--disable-ipv6")
+	}
+
+	if cfg.KubeSolo.DBWALRepair {
+		parts = append(parts, "--db-wal-repair")
+	}
+
 	return strings.Join(parts, " ")
 }