v1.36.0

Added

• service-release.yml takes a platforms input, default linux/amd64:
  the platform the image is built for. A release now ships an x64 image
  from an arm64 runner as well as from an x64 one. Pass another value
  to build for a different cluster; in split mode it must be exactly one
  linux/<arch> entry (for example linux/arm64), which is also what the
  binary is compiled for, and anything else fails the build step.

Changed

• The tools the shared steps fetch when the runner has none (gh,
  kubectl, kustomize) are the build for the runner's architecture, x64
  or arm64, instead of always x64. Every checksum is still verified. A
  runner of any other architecture fails with a message naming it.
  Nothing to change in a caller. The "Ensure kubectl" step of
  service-release.yml is now the shared ensure-kubectl action.

Removed

• runner-health.yml, which moved CI_RUNNER_PRIVATE to ubuntu-latest
  while linux-vm was offline or a job had waited for it over 20 minutes.
  Those hosted minutes billed against the organization's Actions budget,
  and a spent budget fails every private repository's hosted jobs at zero
  steps until the month ends. A private repository's job now waits for the
  self-hosted runner. RUNNER_HEALTH_TOKEN is no longer read, and
  CI_RUNNER_SWITCHES is no longer written.