test: refresh current kernel sweeps

[ErenAri]

Summary

Refreshes the generated kernel-sweep catalog and committed validation baselines against the live kernel-crawler inventory as of 2026-08-09.

• adds and validates current AlmaLinux 9 and Rocky Linux 9 5.14.0-687.36.1.el9_8 profiles
• adds and validates CentOS Stream 9 5.14.0-731.el9
• adds and validates Ubuntu 22.04 generic .189 and .187, lockdown .189, and minimal 5.15.0-1105-kvm
• adds and validates Ubuntu 24.04 generic/minimal 6.8.0-139
• refreshes generated matrices, the enterprise refresh matrix, kernel baselines, and support documentation
• preserves historical profiles while pointing canonical sweep matrices at current validated releases

Merge timing

Draft: do not merge before scheduled v0.4 Campaign 2 completes. This PR does not change the active latest-kernel-sweep graduation matrix or application code, but holding it avoids introducing any catalog/evidence churn immediately before the scheduled campaign.

No tracking issue is required.

KVM evidence

All 10 current kernel targets passed the real static libbpf validator with zero required failures and zero infrastructure errors.

• AlmaLinux report SHA-256: 294e66d92324f65118345ebdf56b5c0c85668fbe5d3ad6d441c29ff9ecfcc7ce
• Rocky report SHA-256: 2d90b59117df6340f715269dd7f8346fb77cd6a9e801336f8e303c92eca99328
• eight-target refresh report SHA-256: 06e324ef0b51452f02d787afb26ab3b8c14151808ea3cdfb36f7495e0af14fb4
• two-release Ubuntu 22.04 report SHA-256: c75532c4b12e48007aa714c1819daf9020f19015382b881435cbc2f9282db69c
• validated artifact SHA-256: 7c8d66cbf12e4b5a877e0c458aee8a939d6de390a4931e3ef40098e931d3707e

Remaining vendor-image lag

The live oracle still reports two honest stale snapshots:

• Amazon Linux 2 public image boots 5.10.260-259.1054, repository newest is .1061
• Amazon Linux 2023 public KVM image boots 6.1.176-223.369, repository newest is 6.1.177-224.371

Both current public images passed validation. Amazon package sweeps are not supported by the current generator, and no newer public KVM image containing those repository kernels was available. This PR deliberately does not claim validation for bytes that were not booted.

Validation

• real KVM installation, reboot, exact uname verification, and libbpf load/attach validation across 10 current targets
• go test ./...
• BPFCOMPAT_DOCS_COMPARE=worktree make check-docs-drift
• make profile-catalog-audit
• git diff --check

[ErenAri]

Merge-timing decision: the maintainer explicitly asked to finish remaining work without waiting for Campaign 2. This change is limited to validated profile/catalog evidence and generated documentation; it does not modify application code or matrices/latest-kernel-sweep.yaml, so the active v0.4 campaign boundary is unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.