Fetch yq as a static binary instead of apk (container has no apk)

Build #13: "apk: not found". This sh step isn't wrapped in
container('docker-cli') — unlike runHooks/buildDocker, it never
specifies a container, so it runs in the auto-injected jnlp agent
container (Debian-based jenkins/inbound-agent), not the Alpine
docker-cli one. git clone worked fine in the same step (Debian image
bundles git), just no apk. Fetches the static mikefarah/yq binary via
curl instead of relying on any particular package manager being
present, to /tmp rather than /usr/local/bin since the agent likely
runs as a non-root user.

src/com/homelab/stages/updateHelmTag.groovy

@@ -43,15 +43,23 @@ def run(Map config) {
                 def authedUrl = "${urlParts[0]}://\${GIT_USER}:\${GIT_PASS}@${urlParts[1]}"
                 sh """
                     git clone ${authedUrl} .
-                    # docker:27-cli's Alpine base doesn't ship yq by
-                    # default. Package name is 'yq-go' on Alpine >= 3.20,
-                    # plain 'yq' on older Alpine (both are mikefarah/yq,
-                    # the Go tool this -i/path-expression syntax assumes
-                    # — a same-named 'yq' package on some distros is a
-                    # completely different, Python-based tool). Try both
-                    # rather than guess which Alpine base is current.
-                    apk add --no-cache yq-go 2>/dev/null || apk add --no-cache yq
-                    yq -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}
+                    # This sh step isn't wrapped in container('docker-cli')
+                    # (unlike runHooks/buildDocker), so it runs in the
+                    # auto-injected jnlp agent container by default — a
+                    # Debian-based jenkins/inbound-agent image, not Alpine,
+                    # confirmed by `apk: not found` right after git clone
+                    # worked fine in the same step. No package manager
+                    # assumption is safe here since the underlying
+                    # container/distro isn't pinned — fetch the static
+                    # mikefarah/yq binary directly instead, to /tmp (always
+                    # writable, unlike /usr/local/bin under a non-root
+                    # agent user).
+                    if ! command -v yq >/dev/null 2>&1; then
+                        curl -sL -o /tmp/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+                        chmod +x /tmp/yq
+                    fi
+                    YQ=\$(command -v yq || echo /tmp/yq)
+                    \$YQ -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}
                     git config user.email 'jenkins-ci@homelab.local'
                     git config user.name 'jenkins-ci'
                     git commit -am 'ci: bump ${config.repo_name}/${config.service_name} image tag to ${env.TAG}'