Default cache to /tmp when HOME is unwritable; allow python3 upload when curl is absent (activity-core worker image).
Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install helper, and ESO policy path for offsite lane so railiance01 workers can upload without workstation OIDC (RAILIANCE-WP-0016).
