dunn.dev/pipeline 4.0.1 Fix: ci-runtime-go ships the CA trust bundle + tzdata. The UBI-micro base shipped neither, so a static (CGO-off) Go binary doing outbound TLS failed x509 verification on its first call -- caddy's Let's Encrypt ACME + Cloudflare DNS-01, and bairn's Famly API (total-failure for both). Every other ci-* image already installed ca-certificates on purpose; ci-runtime-go was the outlier. Staged from a throwaway full-UBI builder; final image stays package-manager-free (+3.5MB). ci-runtime-node unaffected (Node uses its own compiled-in root store). Adversarially verified pre-tag: the built image carries 146 valid PEM certs (incl. ISRG Root X1/X2) at Go's x509 paths.