The step ran `sudo k3s ctr images pull` / `ctr run` against the host's containerd. That worked when the runner was the Arch host; since it was containerized (infra#233) the image has no sudo, no ctr and no containerd socket, so the step fails with `sudo: command not found`. It only surfaced now because the buildah wall (infra#241) killed the job before this step ever ran. The deploy job's `Verify rollout` and `Confirm pod running new image` assert the same property against the real workload rather than a 5s throwaway container, which is why tapir dropped its smoke test under the same issue. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf