y-cluster v0.3.4 -> v0.3.6, drop retry workaround

Two y-cluster releases unblock the docker provider on
ubuntu-latest and let the acceptance script collapse to a single
provision call:

- v0.3.5 (Yolean/y-cluster#12) added a host-side /readyz probe
  between the in-container kubeconfig appearing and "k3s ready"
  being declared, closing the docker port-forward race that made
  envoy-gateway install fail with "dial tcp 127.0.0.1:6443:
  connect: connection refused". The 4x retry/sleep-10s
  workaround in this script is dead code now -- each retry tore
  the cluster down and reproduced the deterministic race anyway.
- v0.3.6 (Yolean/y-cluster#15) fixed a separate silent-drop in
  the docker provider's PortBindings: HostIP was left as the
  zero netip.Addr ("invalid IP"), which moby v1.54+ marshals to
  the empty JSON string and Docker Engine 28 dropped silently.

  A second issue with PortBindings still surfaces in some CI
  contexts -- the y-cluster-managed container's
  NetworkSettings.Ports comes back empty even with v0.3.6 -- but
  it's distinct from anything this script can work around;
  filed upstream against y-cluster.

The y-kustomize Deployment image is bumped to the matching
v0.3.6 tag for consistency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: solsson

bin/y-bin.runner.yaml

@@ -156,14 +156,14 @@ cue:
     path: cue
 
 cluster:
-  version: 0.3.4
+  version: 0.3.6
   templates:
     download: https://github.com/Yolean/y-cluster/releases/download/v${version}/y-cluster_v${version}_${os}_${arch}
   sha256:
-    darwin_amd64: fde0f0b7a7575413036590d9d18d994d0e4f90c484e2a839fe148a85a8bf84da
-    darwin_arm64: 338c5429911dfe7bf46acd829e6961116857ec00602a134549852e3fe591152c
-    linux_amd64: 71c0877736eb39d954a3955456a84416af834b1d4f56639f516c106066512c40
-    linux_arm64: 1b2d99af1cc99354a270108b4ec393d763e34531d78d2d76a1ad3bc0b34f7700
+    darwin_amd64: bc1d008968c09b49bac147324c60c65a7832daed9fa64e226b08f4fc76414631
+    darwin_arm64: ede0610738de938900028a5c66ce66a71fa954d1de2ae5ba00c429ea9dc7f2d8
+    linux_amd64: 576964a8825f23c56b633ea5cbc0b587d25931c17c462e0d77a4ae80553146ae
+    linux_arm64: 9b03cf2dc26bde4af8b65f04ee9a1ad7c22f39bcf77d0d54e25d964bc2b2fd43
 
 contain:
   version: 0.9.1

e2e/agents-clusterautomation-acceptance-linux-amd64.sh

@@ -76,42 +76,16 @@ cleanup
 
 # --- provision (no converge) ---
 #
-# y-cluster v0.3.4 fixed the docker auto-pull issue
-# (ISSUE_DOCKER_PROVIDER_NO_AUTO_PULL.md, fix in commit a959eb0).
-# One known race remains -- ISSUE_DOCKER_K3S_READY_BEFORE_APISERVER.md:
-# the "k3s ready" signal fires when /etc/rancher/k3s/k3s.yaml
-# exists in the container, but the host's :6443 port forward
-# isn't always reachable yet, and the next step (envoy-gateway
-# install via kubectl apply) fails with "dial tcp 127.0.0.1:6443:
-# connect: connection refused". Workaround: detect the
-# connect-refused error, sleep, retry. Becomes dead code once
-# y-cluster strengthens the readiness check on the host port.
-if [ "$(grep -E '^provider:' "$CONFIG/y-cluster-provision.yaml" | awk '{print $2}')" = "docker" ]; then
-  _PRE_OUT=$(mktemp -t ystack-acceptance-provision.XXXXXX)
-  _attempt=1
-  while [ "$_attempt" -le 4 ]; do
-    if y-cluster provision -c "$CONFIG" 2>&1 | tee "$_PRE_OUT"; then
-      break
-    fi
-    if grep -q 'dial tcp 127.0.0.1:6443: connect: connection refused' "$_PRE_OUT"; then
-      echo "# k3s apiserver host port not reachable yet (y-cluster readiness race); sleeping 10s before retry"
-      sleep 10
-    else
-      cat "$_PRE_OUT" >&2
-      rm -f "$_PRE_OUT"
-      exit 1
-    fi
-    _attempt=$((_attempt + 1))
-  done
-  if [ "$_attempt" -gt 4 ]; then
-    echo "# Provision failed after 4 attempts" >&2
-    rm -f "$_PRE_OUT"
-    exit 1
-  fi
-  rm -f "$_PRE_OUT"
-else
-  y-cluster provision -c "$CONFIG"
-fi
+# y-cluster v0.3.5 added a host-side /readyz probe between the
+# in-container kubeconfig appearing and "k3s ready" being declared,
+# closing the docker port-forward race that made the next step
+# (envoy-gateway install via kubectl apply) fail with "dial tcp
+# 127.0.0.1:6443: connect: connection refused" (Yolean/y-cluster#12).
+# v0.3.6 fixed a separate silent-drop in the docker provider where
+# moby v1.54+ sent every PortBinding's HostIp as the empty string
+# (zero netip.Addr) and Docker Engine 28 dropped them all, so
+# NetworkSettings.Ports came back empty (Yolean/y-cluster#15).
+y-cluster provision -c "$CONFIG"
 
 # Label nodes that don't yet have a cluster identity. Selector form
 # avoids overwriting an existing label on a misclaimed cluster.

y-kustomize/y-kustomize-deployment.yaml

@@ -20,7 +20,7 @@ spec:
         runAsUser: 65532
       containers:
       - name: y-kustomize
-        image: ghcr.io/yolean/y-cluster:v0.3.4@sha256:741446c68b5454355260965141f6d0bb3e68f8bd9cec78ba3af5996040447d0e
+        image: ghcr.io/yolean/y-cluster:v0.3.6@sha256:20ee9c0d83e69ef88a92f11392c82d2eba41eb745415661109fb399783c77b26
         command: ["/usr/local/bin/y-cluster"]
         args:
         - serve