[Ubuntu 26.04][Tracking] Preflight / CI / builder compatibility for Ubuntu 26.04 LTS

## Summary

Ubuntu 26.04 LTS (code name *resolute quokka*, GA April 2026) is not yet a first-class supported host OS for NemoClaw. A quick review of the tree shows the runtime layer is version-agnostic and will most likely *work* on 26.04, but CI, preflight test fixtures, documentation, and at least one hardcoded `ubuntu:24.04` builder base image have not been exercised against 26.04. This issue tracks the work to make Ubuntu 26.04 a `tested` entry in `ci/platform-matrix.json`.

## Motivation

- 24.04 is currently the de-facto target (`ci/platform-matrix.json`, `scripts/setup-spark.sh`, preflight fixtures, troubleshooting docs).
- 26.04 LTS will become the next LTS users adopt on fresh installs, DGX Spark refreshes, and Brev images.
- We want to catch 26.04-specific breakage (cgroup defaults, Docker version, AppArmor 4, Landlock ABI bumps, kernel ≥6.14, glibc ABI drift, k3s-in-Docker regressions) *before* users hit them, not reactively.

## Current state (as of `main` @ b1320d50)

### Runtime / preflight — version-agnostic, expected to work

- `src/lib/onboard/preflight.ts` `assessHost()` parses the `OperatingSystem` string from `docker info` for **display only**; no version allow-list.
- Distro detection only probes package managers (`apt-get` / `dnf` / `yum` / `brew` / `pacman`) at `src/lib/onboard/preflight.ts:361`.
- Landlock gate is `kernel ≥5.13` (`src/lib/onboard.ts:5811`, `:5825`); 26.04 easily clears it.
- cgroup v2 parsing (`parseDockerCgroupVersion`) already covers v2, which 26.04 ships by default.
- `scripts/install.sh` and `scripts/install-openshell.sh` contain zero hardcoded Ubuntu version checks.

### Hardcoded `ubuntu:24.04` builder — will keep working, but worth tracking

`src/lib/cluster-image-patch.ts:98,136` pins the fuse-overlayfs builder stage:

```
FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b
```

This runs *inside Docker*, so a 26.04 host can still pull and build it. The comment at `src/lib/cluster-image-patch.ts:127` claims the builder's glibc ABI must match the upstream k3s cluster image. When k3s upstream bumps its base to `questing`/`resolute`, this digest must be bumped in lockstep.

### Test fixtures — 24.04-only

`test/install-preflight.test.ts` has **6 fixtures** hard-coding `\"OperatingSystem\":\"Ubuntu 24.04\"` at lines 684, 786, 893, 1143, 1214, 1597. No 26.04 branch.

### CI — no 26.04 coverage

All workflows in `.github/workflows/` run on `ubuntu-latest` or `ubuntu-24.04-arm` (see `sandbox-images-and-e2e.yaml:89`, `nightly-e2e.yaml` ×14). GitHub `ubuntu-latest` typically lags one LTS, so it will **not** automatically become 26.04 for months.

### Docs / templates — lag behind

- `docs/get-started/prerequisites.md:51` — mentions only 24.04.
- `docs/reference/troubleshooting.md:235,748,926,946` — all 24.04-specific language.
- `docs/security/best-practices.md:273` — references 22.04 LTS for Landlock.
- `.github/ISSUE_TEMPLATE/bug_report.yml:31` — example OS is `Ubuntu 24.04`.
- `ci/platform-matrix.json` (last updated 2026-04-08) has no Ubuntu-version granularity.
- `scripts/setup-spark.sh:7,94` — comments assume Spark is on 24.04.
- Generated user skills under `.agents/skills/nemoclaw-user-*/` inherit the same 24.04 wording (autogenerated from `docs/`).

## Proposed work

### P0 — landing CI and preflight signal

- [ ] Add an `ubuntu-26.04` runner lane to `nightly-e2e.yaml` (at minimum `cloud-e2e` + a small install/onboard smoke) so we get a recurring signal.
- [ ] Extend `test/install-preflight.test.ts` with at least one fixture covering `\"OperatingSystem\":\"Ubuntu 26.04\"` to prove preflight does not regress on parsing.
- [ ] Add a 26.04 case to `test/platform.test.ts` (release / os-release surface).

### P1 — validate the stack end-to-end on 26.04

- [ ] Verify `nemoclaw onboard` (NVIDIA-endpoint path) on a 26.04 host with Docker ≥28 and the containerd image store enabled.
- [ ] Verify the fuse-overlayfs patched cluster image built from `ubuntu:24.04` builder loads and runs against whatever k3s cluster image ships when 26.04 is GA (glibc cross-version check).
- [ ] Verify AppArmor 4 + seccomp defaults in 26.04 do not reject `nemoclaw-blueprint/scripts/seccomp-guard.js` or the sandbox init in `scripts/lib/sandbox-init.sh`.
- [ ] Verify Landlock ABI interaction in `src/lib/shields/index.ts` against the 26.04 kernel.

### P1 — documentation

- [ ] Update `ci/platform-matrix.json` with explicit `ubuntu_versions` field listing 22.04 / 24.04 / 26.04 and their status.
- [ ] Refresh `docs/get-started/prerequisites.md`, `docs/reference/troubleshooting.md`, `docs/security/best-practices.md` to mention 26.04.
- [ ] Bump the example in `.github/ISSUE_TEMPLATE/bug_report.yml`.
- [ ] Regenerate user skills under `.agents/skills/nemoclaw-user-*/` once docs land (follow `nemoclaw-contributor-update-docs` skill).

### P2 — housekeeping

- [ ] Add a 26.04 parallel variant to `test/e2e/Dockerfile.full-e2e` (currently `FROM ubuntu:24.04`).
- [ ] Update `scripts/setup-spark.sh` comments to stop asserting 24.04.
- [ ] Track k3s upstream cluster-image glibc upgrade; when it jumps past noble, bump `UBUNTU_BUILDER_DIGEST` in `src/lib/cluster-image-patch.ts:98` and the matching test fixture in `src/lib/cluster-image-patch.test.ts`.

## Acceptance criteria

- Nightly CI has at least one green `ubuntu-26.04` lane.
- `ci/platform-matrix.json` lists Ubuntu 26.04 as `tested` with evidence linked.
- Preflight unit tests cover 26.04 `docker info` output.
- Docs and the bug-report template reference 26.04 where appropriate.

## Known related issues (not 26.04, but same area)

- #3174 — [Ubuntu 24.04][Onboard] preflight nvidia-smi / nvidia-container-toolkit detection
- #1182 — [Ubuntu 24.04] GPU not detected during onboard
- #3115 — [Linux][Install] onboard exits 0 when Docker is not running
- #2754 (closed) — [Ubuntu 24.10][Onboard] OPENSHELL_BIN ignored by preflight
- #2765 (closed) — [Linux][Onboard] stale onboard.lock after preflight failure

None of them specifically cover 26.04; this issue is the first to track it.