refactor: cross-platform tool downloads, configurable infra dir and ACME email

- Make tool downloads platform-aware (darwin/linux, arm64/amd64)
- Add buildctl to bundled tools
- Add get_infra_dir() with config fallback for REPO_ROOT resolution
- Add ACME email to sunbeam config (set/get)
- Add REGISTRY_HOST_IP substitution in kustomize builds
- Update Kratos admin identity schema to employee
- Fix logs command to use production tunnel and context

sunbeam/cluster.py

@@ -12,7 +12,8 @@ from sunbeam.tools import run_tool, CACHE_DIR
 from sunbeam.output import step, ok, warn, die
 
 LIMA_VM = "sunbeam"
-SECRETS_DIR = Path(__file__).parents[3] / "infrastructure" / "secrets" / "local"
+from sunbeam.config import get_infra_dir as _get_infra_dir
+SECRETS_DIR = _get_infra_dir() / "secrets" / "local"
 
 GITEA_ADMIN_USER = "gitea_admin"