## Hermetic build disabled by default; bundle build performs live network fetches

**Component:** olm-operator-konflux-sample

Hermetic build mode is disabled by default in the shared pipelines, and the bundle build performs live network fetches (including in-build `skopeo inspect` calls for architecture detection) rather than relying on prefetched, verified inputs.

### Remediation
Set `hermetic` default to `"true"` in both shared pipelines, supply `prefetch-input` for the gatekeeper/gatekeeper-operator Go builds, and replace the in-build `skopeo inspect` arch detection with statically-declared arch labels (the supported arch set is already known from `build-platforms`).

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-002*