fix(ci): allow pasta to receive Podman stop signals

[elezar]

Summary

Allow the confined pasta helper to receive Podman’s graceful stop signal in the rootless Podman E2E environment, and fail CI if that denial recurs.

Related Issue

Fixes#2844

Changes

• Add the narrowly scoped signal (receive) peer=podman, AppArmor rule.
• Reload the packaged pasta profile before the E2E suite.
• Fail the shared rootless Podman job when the original pasta-from-Podman SIGTERM denial appears in dmesg.
• Document that the workaround remains until Ubuntu packages the upstream profile fix.

Testing

• mise run pre-commit passes
• E2E test run passed before adding the regression assertion; this PR’s CI will validate the updated guard.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied, but pull-request/2900 does not exist yet. A maintainer needs to comment /ok to test e30435fc72894b29f654d67cb2ab6b6f0fd723b9 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

/ok-to-test

[elezar]

@politerealism could you please review this change as a fix for #2844?

[politerealism]

Hey @elezar I like that you restricted the grant to receive from peer=podman only, which is the more conservative, least-privilege option. Better as a security minded approach.

Recommend:

• Manual re-run at least two time before closing issue fully
• Update label from state:validated to state:accepted on 2844
• There are two gaps on single-run verification and diagnostic-only dmesg check that are low ongoing risk and forward risk that should be addressed. I will document and open these as potential improvements, but should not directly impact this current work.

Assessment:

Looks good. Resolves issue #2844 and will fix flaky test. Thank you @elezar

[elezar]

/ok-to-test