feat(linux): onboard Ubuntu 26.04 minimal image builds for AMD64 + ARM64

[cameronmeissner]

What this PR does / why we need it:

Onboards Ubuntu 26.04 (Resolute) minimal VHD builds for both AMD64 and ARM64 (Gen2), replacing the retired 22.04 minimal SKUs. Confirmed with @allyford that removal of the 2204 minimal SKUs is correct.

Alongside the 26.04 enablement, this PR does a fair amount of refactoring of the VHD build + CSE provisioning scripts so that a single code path cleanly supports 22.04 / 24.04 / 26.04 (and the minimal image variant) instead of branching on ad-hoc IMG_SKU string matching.

Important

Follow-up PRs are required to add acr-mirror (artifact streaming) and blobfuse2 (Azure Blob CSI fuse driver) support on the new 26.04 images. Both packages are not yet published in the Resolute (26.04) PMC repos, so they are intentionally stubbed out on 26.04 for now and marked with TODO(2604) in install-dependencies.sh. See the Known gaps / follow-ups section below.

---

Scope of the 26.04 onboarding

Build pipeline / SKUs

• .vsts-vhd-builder-release.yaml: swapped the 2204 minimal gen1/gen2 build jobs for 2604 minimal gen2 (AMD64, Standard_D16ds_v5) and 2604 minimal arm64 gen2 (Standard_D16pds_v5). New offer/SKU: ubuntu-26_04-lts / minimal + minimal-arm64, Gen V2, FEATURE_FLAGS=minimal.
• .builder-release-template.yaml: SKU-name derivation now appends minimal from FEATURE_FLAGS (instead of matching IMG_SKU).

Package definitions

• parts/common/components.json: added r2604 entries for the full core set (containerd, runc, cni-plugins, cri-tools, kubelet/kubectl, azure-acr-credential-provider, ig/inspektor-gadget, aks-secure-tls-bootstrap-client, nvidia-device-plugin, dra-driver-nvidia-gpu, dcgm packages, dcgm-exporter, node-exporter). Also bumped shared GPU package versions (dcgm 4.5.3→4.6.0, dcgm-exporter 4.8.2→4.8.3, nvidia-device-plugin uN bumps).
• schemas/components.cue: added the r2604 release key.

CSE provisioning (cse_install_ubuntu.sh)

• 26.04 added to the aznfs / irqbalance / systemd-resolved / aznfswatchdog branches.
• On 26.04, linux-modules-extra-* is dropped from the package list (its contents are bundled into linux-modules-* on Resolute).
• PMC repo trust: 26.04 additionally imports Microsoft's newer 2025 GPG key (microsoft-2025.asc).
• NVIDIA repo: dearmors the ASCII-armored key into a binary nvidia.gpg keyring (apt 3.x on 26.04 rejects a raw .pub), uses the 60DF8A40.pub key + ubuntu2604 repo.
• New installMinimalBuildDeps / installUbuntu2604MinimalBuildDeps to pull minimal-image build prerequisites (rsyslog, gpg).

CIS / hardening (cis.sh)

• Root PW hashing: 26.04 ships Python 3.14 which removed the crypt module, so we switch to passlib's pure-Python sha512_crypt (rounds=5000 to match crypt(3)).
• New preferClassicSudo: 26.04 defaults to sudo-rs, which doesn't support Defaults logfile; we select classic sudo via update-alternatives so the CIS /var/log/sudo.log audit trail is preserved.

Build / scan / test infra

• pre-install-dependencies.sh: installs minimal build deps when isMinimalImage && isUbuntu.
• post-install-dependencies.sh: PackageKit purge now guarded by isMinimalImage (minimal doesn't ship it).
• trivy-scan.sh: added 2604 trivy deb version; restructured install_azure_cli (guard clauses + PMC helper); 26.04 installs az via pip (--break-system-packages) as a TODO(2604) until the Resolute az package exists; import 2025 PMC key.
• vhd-scanning.sh: skip CIS scanning on 26.04 (TODO(2604) — upstream CIS benchmarks not yet available).
• linux-vhd-content-test.sh: skip BCC-tools check on 26.04; packer_source.sh reuses the 2204 PAM config for 26.04.

E2E coverage (e2e/)

• New VHDUbuntu2604MinimalGen2Containerd + ...Arm64... image defs and DCGM compatibility entries.
• New 26.04-minimal scenarios: base bootstrap (containerd v2), Azure CNI, NPD, secondary NIC (+ dual-stack), secure-TLS-bootstrap fallback, RCV1P cert mode, and GPU (A10 GRID, H100, MIG / MIG-mixed, DRA driver). The base bootstrap scenarios assert blobfuse2 is installed (will exercise the follow-up work).

General refactoring

• OS detection: replaced the gawk 'match(...)' ID/VERSION_ID/VARIANT_ID parsing with a portable sed | head | tr pipeline across install-dependencies.sh, pre/post-install-dependencies.sh, cse_helpers.sh, and cse_install.sh — gawk is not present on the minimal image.
• install-dependencies.sh: removed the large inlined top-level per-package install block and drove it from a components.json-based case dispatch loop; extracted the shared aptGetBatchInstallPackagesWithFallback helper; minimal-vs-full gating now via isMinimalImage / FEATURE_FLAGS=minimal rather than IMG_SKU substring matching. eBPF/BCC tooling is skipped on 26.04.
• isMinimalImage helper added to cse_helpers.sh; installMinimalBuildDeps stubbed for the non-Ubuntu OSes (mariner, flatcar, acl, osguard).
• Misc cleanups: tool_installs_ubuntu.sh error-code comments de-templatized + shellcheck || exit 1 guards; no-sudo-check.yml allowlists update-alternatives; typo fixes (Ingoring→Ignoring).

Known gaps / follow-ups

These are intentionally deferred and must land in follow-up PRs once the packages are available in the Resolute (26.04) PMC repos:

• acr-mirror (artifact streaming) — TODO(2604) in install-dependencies.sh; not yet in resolute PMC.
• blobfuse2 (Azure Blob Storage CSI fuse driver) — TODO(2604) in install-dependencies.sh; not yet in resolute PMC. E2E already asserts its presence, so the 2604 bootstrap tests will drive closure of this gap.
• azure-cli from PMC — 26.04 currently installs az via pip in trivy-scan.sh; swap to the PMC package when published (TODO(2604)).
• CIS benchmark scanning — re-enable for 26.04 in vhd-scanning.sh once upstream CIS publishes Resolute benchmarks (TODO(2604)).

Note: a couple of build-loop debugging tweaks are present for the draft (VHD-build retryCountOnTaskFailure temporarily commented out; release-notes publish set to always()) and should be reverted before this leaves draft.

Which issue(s) this PR fixes:
Fixes #