shell: include Cilium debug tooling (cilium-dbg, cilium-bugtool)

**Is your feature request related to a problem? Please describe.**
Debugging a Cilium-enabled AKS cluster from kubectl retina shell is missing the CLIs operators reach for first: `cilium-dbg` and `cilium-bugtool`. Today the only options are kubectl exec into the cilium-agent container or chroot to the host (binaries aren't on the host only inside the agent image).
Production Cilium agent images have had bash and tar stripped, but cilium-bugtool hard-depends on `bash -c`. The bundle ships but every captured command is replaced by `> Error while running '...': exec: "bash": ...,` and `kubectl cp` then fails because tar is also missing. Operators get no usable debug data from Cilium's canonical debug tool.

**Describe the solution you'd like**
Add `cilium-dbg` and `cilium-bugtool` to `shell/Dockerfile` as release-binary downloads. Same pattern as the existing pwru block at the bottom of that file. The agent socket is at `/var/run/cilium/cilium.sock`; with `--mount-host-filesystem` it shows up at `/host/var/run/...`, and CLIs accept an explicit socket path:
```
kubectl retina shell --mount-host-filesystem --capabilities=NET_ADMIN,SYS_ADMIN
cilium-dbg -H unix:///host/var/run/cilium/cilium.sock status --brief
cilium-bugtool --host unix:///host/var/run/cilium/cilium.sock --archive --output /host/tmp/
```

**Describe alternatives you've considered**
- Fix cilium-bugtool's bash dependency upstream. Worth doing in parallel, but doesn't help operators who want live cilium-dbg endpoint list from the debug pod.
- `kubectl debug -it node/ --image=quay.io/cilium/cilium:vX`. Works, but same bash issue in some builds, requires manual version selection, and undermines the "one debug pod" UX Retina has cultivated.

Start in shell/Dockerfile at the existing pwru release-binary block and follow its download pattern for cilium-dbg and cilium-bugtool. Build the shell image and verify both commands are available; done means the CLIs can use the mounted /host/var/run/cilium/cilium.sock for status and bugtool archive collection.

Written by the indexing model from the issue text.