feat: Ship netcat in the flink-sql-runner image

[velo]

Adds netcat-openbsd to the runner image so nc is available inside JobManager/TaskManager pods.

Why

Debugging a Flink job that cannot reach a sink usually starts with "can this pod open a TCP connection to the broker/database at all?". Without nc in the image that means attaching an ephemeral debug container (which shares the network namespace but not always the same DNS/proxy view, and is unavailable on older clusters or where image pulls are restricted). nc -zv host port answers it in one line, from the same process namespace the job runs in.

netcat-openbsd is added to the existing JDK apt-get install layer, so it costs no extra image layer and ~30 KB.

Usage

kubectl exec -it <taskmanager-pod> -- nc -zv kafka.default.svc.cluster.local 9092
kubectl exec -it <taskmanager-pod> -- nc -zv postgres 5432

Documented in the README next to the async-profiler section, which covers the same "tools that ship in the image for debugging" ground.

Verification

Built the base image with the added package and confirmed the binary resolves:

#6 [3/3] RUN nc -h 2>&1 | head -3 && which nc
#6 0.137 OpenBSD netcat (Debian patchlevel 1.226-1ubuntu2)
#6 0.137 usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl]
#6 0.138 /usr/bin/nc

mvn clean test passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_012YMC1TkuNLcyLkbv4ekqc6