base: install mikefarah yq (pinned v4.53.3), drop Debian python yq

Debian/Ubuntu `apt install yq` is kislyuk/yq (Python, v3.x), incompatible
with the mikefarah v4 syntax the cloud-init repo's provision.sh/deploy.sh
require. Replace the apt package with a pinned mikefarah Go binary, mirroring
the existing tealdeer ARG (latest-or-pin) pattern, multi-arch amd64/arm64.
smoke-test.sh now asserts `yq --version` reports mikefarah so CI catches a
regression. CHANGELOG: Unreleased entry.

CHANGELOG.md

@@ -11,6 +11,23 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
+## Unreleased
+
+### Fixed
+
+- **`yq` is now mikefarah's Go yq, not Debian's Python `yq`.** The base image
+  previously apt-installed `yq`, which on Debian/Ubuntu is the unrelated
+  kislyuk/`yq` (a jq wrapper, v3.x) — incompatible with the mikefarah v4 syntax
+  the `cloud-init` repo's `provision.sh`/`deploy.sh` expect. Dropped the apt
+  package and install a pinned mikefarah binary instead
+  (`ARG YQ_VERSION=v4.53.3`, multi-arch amd64/arm64, follows the repo's
+  tealdeer-style `latest`-or-pin pattern; override with `--build-arg`),
+  matching the `yq` used on control machines (Homebrew `yq` v4.x). The
+  build-time `smoke-test.sh` gate now asserts `yq --version` reports
+  `mikefarah`, so a regression back to the Python package fails CI.
+
+---
+
 ## v1.2.2 — 2026-06-24
 
 Patch release: pick up **pi `0.80.2`** (npm `latest`) and **mempalace `3.5.0`**,