fix(iam): authentik-provision Job failing on apk permission denied

Job was crash-looping: 'apk add --no-cache curl' failed with Permission
denied - the container runs as non-root UID 1000 (securityContext.
runAsNonRoot: true), and both apk's working directories and /usr/local/bin
(where curl-downloaded kubectl was being written) are root-owned in the
python:3.12-alpine base image.

Replaced with a pure-Python download via urllib (stdlib, already a
dependency of this Job) writing to /tmp (world-writable) instead - no apk
install needed at all. PATH is extended to include /tmp before invoking the
provisioning script so authentik-provision.py's existing
subprocess.run(['kubectl', ...]) calls resolve it via normal PATH lookup,
no changes needed to the script itself.

k8s/security/iam/authentik-provision-job.yaml

@@ -479,11 +479,19 @@ spec:
               until wget -q -O /dev/null http://authentik-server.iam.svc.cluster.local/-/health/ready/ 2>/dev/null; do
                 sleep 5
               done
-              echo "installing kubectl..."
+              echo "installing kubectl (via python urllib - no apk/curl: this"
-              apk add --no-cache curl >/dev/null
+              echo "container runs as non-root UID 1000 and can't write to"
-              KVER=$(curl -sL https://dl.k8s.io/release/stable.txt)
+              echo "apk's directories or /usr/local/bin, both root-owned in"
-              curl -sLo /usr/local/bin/kubectl "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl"
+              echo "the python:3.12-alpine image; /tmp is world-writable)..."
-              chmod +x /usr/local/bin/kubectl
+              python3 -c "
+              import urllib.request, os, stat
+              kver = urllib.request.urlopen('https://dl.k8s.io/release/stable.txt').read().decode().strip()
+              url = f'https://dl.k8s.io/release/{kver}/bin/linux/amd64/kubectl'
+              urllib.request.urlretrieve(url, '/tmp/kubectl')
+              st = os.stat('/tmp/kubectl')
+              os.chmod('/tmp/kubectl', st.st_mode | stat.S_IEXEC)
+              "
+              export PATH="/tmp:$PATH"
               echo "running provisioning script..."
               python3 /script/authentik-provision.py
       volumes: