fix(temporal): db-secret-sync image bitnami/kubectl:1.30 doesn't exist

Bitnami stopped publishing versioned image tags in 2025 - only 'latest' and
sha256-pinned digests remain for their free-tier images. Confirmed via
Docker Hub API before writing this fix: no '1.30' tag exists for
bitnami/kubectl, which caused an indefinite ImagePullBackOff (job stuck
'Running' with 0 pods able to start).

Switched to python:3.12-alpine + a stdlib urllib kubectl download, matching
the exact pattern already proven working in
k8s/security/iam/authentik-provision-job.yaml (which hit its own apk
permission problem on this same base image, now fixed the same way in
both places) - avoids depending on any third party's tagging policy.

k8s/applications/temporal/db-secret-sync/copy-job.yaml

@@ -91,7 +91,15 @@ spec:
           type: RuntimeDefault
       containers:
         - name: copy
-          image: bitnami/kubectl:1.30
+          # bitnami/kubectl:1.30 does NOT exist - Bitnami stopped publishing
+          # versioned tags in 2025 (only `latest` + sha256-pinned digests
+          # remain), confirmed live via Docker Hub API before this fix - the
+          # original tag caused an indefinite ImagePullBackOff. Using
+          # python:3.12-alpine + a stdlib urllib kubectl download instead,
+          # same pattern already proven working in
+          # k8s/security/iam/authentik-provision-job.yaml - avoids depending
+          # on any third party's tagging policy at all.
+          image: python:3.12-alpine
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -101,6 +109,17 @@ spec:
             - -c
             - |
               set -e
+              echo "installing kubectl (pure python urllib, no apk - see"
+              echo "authentik-provision-job.yaml for why apk fails as non-root)..."
+              python3 -c "
+              import urllib.request, os, stat
+              kver = urllib.request.urlopen('https://dl.k8s.io/release/stable.txt').read().decode().strip()
+              url = f'https://dl.k8s.io/release/{kver}/bin/linux/amd64/kubectl'
+              urllib.request.urlretrieve(url, '/tmp/kubectl')
+              st = os.stat('/tmp/kubectl')
+              os.chmod('/tmp/kubectl', st.st_mode | stat.S_IEXEC)
+              "
+              export PATH="/tmp:$PATH"
               echo "waiting for ddb/temporal-db-role..."
               until kubectl -n ddb get secret temporal-db-role >/dev/null 2>&1; do
                 echo "  not ready yet, retrying..."