kubernetes was manually updated to 4437.v3a_18554d3f32 via the Jenkins UI (the pin still said 4353.vb_47977da_9417) — this combination, paired with kubernetes-client-api:7.3.1-256.v788a_0b_787114, is what got a real build through checkout successfully. Pinning it here so a future restart/reprovision reinstalls the version that's actually been proven to work, not the untested original pin.