y-cluster: pin v0.3.3 -> v0.3.4, drop dead auto-pull workaround

v0.3.4 ships the docker auto-pull fix (a959eb0) responding to
ISSUE_DOCKER_PROVIDER_NO_AUTO_PULL.md: ContainerCreate now does an
ImagePull first when the image isn't on disk. The acceptance
script's pre-pull fallback (scrape image ref + docker pull on the
"No such image" failure path) is dead code on v0.3.4 and is
removed in the same commit.

The other docker-provider race
(ISSUE_DOCKER_K3S_READY_BEFORE_APISERVER.md) is not addressed in
v0.3.4 -- the connect-refused retry stays in place until y-cluster
strengthens the readiness check on the host's :6443 port.

Both pins land at the same SHA (host wrapper +
y-kustomize Deployment image) so a fresh provision and the
in-cluster Deployment serve from one binary.

Verified locally with cold image cache: provision auto-pulls,
validate-ystack reports 37 passed, 0 failed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Yolean k8s-qa

bin/y-bin.runner.yaml

@@ -156,14 +156,14 @@ cue:
     path: cue
 
 cluster:
-  version: 0.3.3
+  version: 0.3.4
   templates:
     download: https://github.com/Yolean/y-cluster/releases/download/v${version}/y-cluster_v${version}_${os}_${arch}
   sha256:
-    darwin_amd64: 28b1059ba2757e530dd5909820e5acb212dc0769873e94cdcdfdbce710c3a639
-    darwin_arm64: ccf3c8c2251ff8fda33db76d7ef4c76d06122ad34f0a20902e2d79ca2817840a
-    linux_amd64: 652711a28b9e74e4590d1e7f5bee5a592ed7f0d2617cffb67a58cb15baa9db6a
-    linux_arm64: a504471dd37d8bba17e94529d67389cf3895f1e13a13507e26c4c03a37ee697c
+    darwin_amd64: fde0f0b7a7575413036590d9d18d994d0e4f90c484e2a839fe148a85a8bf84da
+    darwin_arm64: 338c5429911dfe7bf46acd829e6961116857ec00602a134549852e3fe591152c
+    linux_amd64: 71c0877736eb39d954a3955456a84416af834b1d4f56639f516c106066512c40
+    linux_arm64: 1b2d99af1cc99354a270108b4ec393d763e34531d78d2d76a1ad3bc0b34f7700
 
 contain:
   version: 0.9.1

e2e/agents-clusterautomation-acceptance-linux-amd64.sh

@@ -76,37 +76,25 @@ cleanup
 
 # --- provision (no converge) ---
 #
-# y-cluster v0.3.3's docker provider has two known races (filed
-# against y-cluster as ISSUE_DOCKER_PROVIDER_NO_AUTO_PULL.md and
-# ISSUE_DOCKER_K3S_READY_BEFORE_APISERVER.md):
-#
-#   1. ContainerCreate is called without a prior `docker pull`,
-#      so a fresh host errors with "No such image". Workaround:
-#      scrape the image ref from the failed log, pull, retry.
-#   2. The "k3s ready" signal fires when /etc/rancher/k3s/k3s.yaml
-#      exists in the container, but the host's :6443 port forward
-#      isn't always reachable yet -- the next step
-#      (envoy-gateway install via kubectl apply) fails with
-#      "dial tcp 127.0.0.1:6443: connect: connection refused".
-#      Workaround: detect the connect-refused error, sleep, retry.
-#
-# Both branches reduce to a single `y-cluster provision -c "$CONFIG"`
-# once y-cluster ships fixes.
+# y-cluster v0.3.4 fixed the docker auto-pull issue
+# (ISSUE_DOCKER_PROVIDER_NO_AUTO_PULL.md, fix in commit a959eb0).
+# One known race remains -- ISSUE_DOCKER_K3S_READY_BEFORE_APISERVER.md:
+# the "k3s ready" signal fires when /etc/rancher/k3s/k3s.yaml
+# exists in the container, but the host's :6443 port forward
+# isn't always reachable yet, and the next step (envoy-gateway
+# install via kubectl apply) fails with "dial tcp 127.0.0.1:6443:
+# connect: connection refused". Workaround: detect the
+# connect-refused error, sleep, retry. Becomes dead code once
+# y-cluster strengthens the readiness check on the host port.
 if [ "$(grep -E '^provider:' "$CONFIG/y-cluster-provision.yaml" | awk '{print $2}')" = "docker" ]; then
   _PRE_OUT=$(mktemp -t ystack-acceptance-provision.XXXXXX)
   _attempt=1
   while [ "$_attempt" -le 4 ]; do
     if y-cluster provision -c "$CONFIG" 2>&1 | tee "$_PRE_OUT"; then
       break
     fi
-    if grep -q 'No such image' "$_PRE_OUT"; then
-      _IMG=$(grep -oE 'ghcr\.io/yolean/k3s:[a-zA-Z0-9._-]+' "$_PRE_OUT" | head -1)
-      if [ -n "$_IMG" ]; then
-        echo "# Pre-pulling $_IMG (y-cluster v0.3.3 docker provider does not auto-pull)"
-        docker pull "$_IMG"
-      fi
-    elif grep -q 'dial tcp 127.0.0.1:6443: connect: connection refused' "$_PRE_OUT"; then
-      echo "# k3s apiserver host port not reachable yet (y-cluster v0.3.3 readiness race); sleeping 10s before retry"
+    if grep -q 'dial tcp 127.0.0.1:6443: connect: connection refused' "$_PRE_OUT"; then
+      echo "# k3s apiserver host port not reachable yet (y-cluster readiness race); sleeping 10s before retry"
       sleep 10
     else
       cat "$_PRE_OUT" >&2

y-kustomize/y-kustomize-deployment.yaml

@@ -20,7 +20,7 @@ spec:
         runAsUser: 65532
       containers:
       - name: y-kustomize
-        image: ghcr.io/yolean/y-cluster:v0.3.3@sha256:34b95376d1aecbfa08020aacc61d3f25d9c7cafe1e5b6c3321f9ce9ee59b54d2
+        image: ghcr.io/yolean/y-cluster:v0.3.4@sha256:741446c68b5454355260965141f6d0bb3e68f8bd9cec78ba3af5996040447d0e
         command: ["/usr/local/bin/y-cluster"]
         args:
         - serve