The CVE-hardening pass purged yq (vulnerable Go stdlib in the base copy),
but kasmvnc-entrypoint.sh hard-depends on it to render kasmvnc.yaml. With
yq gone, the kasmvnc supervisor program went FATAL on every fresh
container, leaving a blank :21 desktop that container/nginx/Xvnc liveness
all miss.
Reinstall yq (mikefarah v4) as a current static binary after the purge —
a recent release carries the patched Go stdlib that motivated the removal.
yq is only needed at container runtime, so purge-then-reinstall ordering
is safe; `yq --version` validates the download at build time.
19537deb11