PR builds can't pull ci-base (no GCP secrets on pull_request events). dev.yaml falls back to committed bin/ + runtime/ instead. Extracted from ci-base:latest (sdk-release.yaml run 1411).
