fix(backups): supply the catalogue mirror runtime tools #4295

🤖 Generated by the Agentic Engineer

The reviewed backup catalogue mirror stopped before copying because its pinned client image lacks the shell tools required by the mirror script. The real dispatch failed its tool preflight; host-based fixtures had not exercised that image.

Provide the required tools without weakening the mirror's checks. Keep the pod unprivileged and credential configuration in memory. Add a real container runtime check to CI, then repeat the production mirror and record its parity verdict.

The real-image CI check also observed that the old official image path returns an authorization error for both its release tag and pinned digest. The current official client path resolves successfully. Include that pinned client update in the repair so an uncached runner or node can fetch it.

Part of #3767.