Remove remaining runtime package installs from workflow templates

[castrojo]

Per the policy now in docs/skills/gitops-argocd/image-policy.md and AGENTS.md:
do not use RPM/dnf — not at runtime, not in a Containerfile, not in a builder
stage. When the org does not publish the image we need, propose adding one to
fsdk-containers.

Runtime installs bypass the registry allowlist entirely (scripts/check_gitops_policy.py
only inspects image: lines), so they are an ungoverned supply-chain ingress that no
lint run flags. They also make pipelines unreproducible and hard-down whenever an
upstream mirror is.

Already done

Swapped to ghcr.io/projectbluefin/lab-runner:latest (verified contents: bash, curl,
git, jq, python3.13, kubectl) and the dnf line deleted:

• service-catalog-pipeline.yaml — also fixed a latent bug: it called kubectl before installing kubernetes-client
• run-service-tests.yaml (git-sync initContainer)
• knuckle-qa-pipeline.yaml (source clone step)
• provision-flatcar-vm.yaml (wait-for-flatcar-ready)

Remaining — needs an org image, not a swap

lab-runner does not contain skopeo, oras, tar, yq, PyYAML or podman (verified
2026-08-21), so these cannot be fixed by changing the image alone.

File	Installs	Blocker
knuckle-qa-pipeline.yaml	buildah	org publishes distroless buildah — needs multi-stage COPY or init container (no shell)
provision-flatcar-vm.yaml	qemu-img bzip2 buildah	org publishes distroless qemu-img + buildah; bzip2 unresolved
build-bluefin-migration-containerdisk.yaml	qemu-img jq buildah + ISO deps	same
bluefin-server-boot-test.yaml	zstd podman	no org image
iso-e2e-pipeline.yaml, iso-build-e2e-pipeline.yaml	ISO build toolchain	candidate for a dedicated fsdk-containers ISO builder image
run-service-tests.yaml	python3-pytest openssl	pytest/openssl absent from lab-runner
homelab-print-device.yaml	avahi-daemon avahi-utils (apt)	no org image

Out of scope

run-gnome-tests.yaml, run-kde-tests.yaml, run-flatcar-tests.yaml and
run-systemd-container-tests.yaml pip install inside the guest/DUT being
tested (qecore, dogtail, behave). That is provisioning the device under test, not
runner tooling — changing it would change what is being tested.

Suggested order

1. Propose an fsdk-containers image for the ISO/disk toolchain (qemu-img, buildah, zstd, xorriso) — unblocks the most files at once.
2. Convert buildah/qemu-img call sites to multi-stage COPY --from against the existing distroless org images.
3. Add pytest/openssl to a test-runner image or vendor them.