The runner-pod probe cannot be transferred to buildkitd: different namespace, different NetworkPolicies, so an UNREACHABLE there may be policy rather than routing. This curls through a buildctl build, which egresses from the buildkitd pod that actually has to push.