ci(release): run Linux release canaries in QEMU VMs

[drew]

Summary

Run the Linux release install canaries inside the reusable QEMU guests introduced by #2471. The workflow validates Ubuntu with Docker and Fedora with rootless Podman and SELinux on public GitHub-hosted runners, while retaining a software-emulation fallback when KVM is unavailable.

Stack

Child of #2471, which provides the base QEMU VM infrastructure.

Related Issue

Stacked on #2471.

Changes

• Replace host-level Ubuntu and containerized Fedora install checks with VM-backed release canaries
• Test Ubuntu/Docker and Fedora/Podman with SELinux enforcing
• Run the canaries on public AMD64 and ARM64 GitHub-hosted runners
• Exercise KVM when available and QEMU TCG fallback behavior otherwise
• Use QEMU firmware for ARM64 TCG fallback
• Test the rolling dev Debian and RPM packages
• Update release-canary guidance and build architecture documentation

Testing

• mise run pre-commit passes
• nix run .#test-vm -- --list
• Flake app evaluation for x86_64-linux, aarch64-linux, and aarch64-darwin
• Ubuntu 24.04 ARM64 VM installs the dev Debian package and reaches the Docker-backed gateway
• Fedora 44 ARM64 VM installs the dev RPM packages and reaches the Podman-backed gateway with SELinux enforcing
• Ubuntu and Fedora AMD64 release canaries pass on public GitHub runners
• ARM64 TCG behavior benchmarked on public GitHub runners

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Parent PR is linked

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.