ci: pin image via generated overlay instead of downloading kustomize

kubectl's built-in kustomize applies a temporary overlay that overrides
the image tag, removing the slow kustomize download from GitHub.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -119,21 +119,23 @@ jobs:
 
           KUBECONFIG="${KUBECONFIG_PATH}" kubectl cluster-info --request-timeout=15s
 
-      - name: Set up kustomize
-        env:
-          KUSTOMIZE_VERSION: v5.7.1
-        run: |
-          mkdir -p "${RUNNER_TEMP}/bin"
-          curl -fsSL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz" \
-            | tar -xz -C "${RUNNER_TEMP}/bin" kustomize
-          echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
-
+      # Overlay that pins the image to this commit, using kubectl's built-in kustomize.
       - name: Pin image to this commit
-        working-directory: k8s
-        run: kustomize edit set image "jesseinit-portfolio=${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
+        run: |
+          mkdir -p k8s-deploy
+          cat > k8s-deploy/kustomization.yaml <<EOF
+          apiVersion: kustomize.config.k8s.io/v1beta1
+          kind: Kustomization
+          resources:
+            - ../k8s
+          images:
+            - name: ${REGISTRY}/${IMAGE_NAME}
+              newTag: sha-${GITHUB_SHA}
+          EOF
+          kubectl kustomize k8s-deploy/ | grep 'image:'
 
       - name: Apply manifests
-        run: kubectl apply -k k8s/
+        run: kubectl apply -k k8s-deploy/
 
       - name: Wait for rollout
         run: |

k8s/kustomization.yaml

@@ -15,7 +15,7 @@ labels:
       app.kubernetes.io/name: personal-site
       app.kubernetes.io/managed-by: kustomize
 
-# CI pins this to sha-<commit> with `kustomize edit set image` before applying.
+# CI pins the tag to sha-<commit> via a generated overlay (see deploy.yml).
 images:
   - name: jesseinit-portfolio
     newName: tea.jesseinit.dev/jesseinit/personal-site