ci(release): run Linux release canaries in QEMU VMs

[drew]

Summary

Run the Linux release install canaries inside the reusable QEMU guests introduced by #2471. The workflow validates Ubuntu with Docker and Fedora with rootless Podman and SELinux on public GitHub-hosted runners, while retaining a software-emulation fallback when KVM is unavailable.

Stack

Child of #2471, which provides the base QEMU VM infrastructure.

Related Issue

• feat: E2E and release testing improvements #2527
• Stacked on test(e2e): add reusable QEMU infrastructure for E2E tests #2471.

Changes

• Replace host-level Ubuntu and containerized Fedora install checks with VM-backed release canaries
• Test Ubuntu/Docker and Fedora/Podman with SELinux enforcing
• Run the canaries on public AMD64 and ARM64 GitHub-hosted runners
• Exercise KVM when available and QEMU TCG fallback behavior otherwise
• Use QEMU firmware for ARM64 TCG fallback
• Test the rolling dev Debian and RPM packages
• Update release-canary guidance and build architecture documentation

Testing

• mise run pre-commit passes
• nix run .#test-vm -- --list
• Flake app evaluation for x86_64-linux, aarch64-linux, and aarch64-darwin
• Ubuntu 24.04 ARM64 VM installs the dev Debian package and reaches the Docker-backed gateway
• Fedora 44 ARM64 VM installs the dev RPM packages and reaches the Podman-backed gateway with SELinux enforcing
• Ubuntu and Fedora AMD64 release canaries pass on public GitHub runners
• ARM64 TCG behavior benchmarked on public GitHub runners

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Parent PR is linked

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.