Rollout restart is enough — status monitoring is optional and
fails with fsnotify watcher limit in the CI pod.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docker-buildx requires privileged mode which is blocked in
Woodpecker v3. Kaniko builds in userspace, matching bcard setup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>