Platform images (cron/server/worker/launcher) ship on End-of-Life Amazon Linux 2 (SUPPORT_END 2026-06-30)

### Helm Chart Version

2.1.0

### What step the error happened?

Other

### Relevant information

### Summary
All Airbyte **platform** images are built on **Amazon Linux 2**, which reaches end-of-life on **2026-06-30** (per the image's own `/etc/os-release`). After that date AWS stops publishing ALAS security patches, so the OS-level CVEs already present in these images become **permanently unpatchable**.

This is flagged as a critical/high finding by image scanners (Wiz, Trivy). It is not fixable by upgrading: the **latest `master` build is still on Amazon Linux 2** (see "Relevant log output").

Note: `airbytehq/airbyte-platform` has GitHub Issues disabled, so filing here per project convention.

### Affected images (app version `2.1.0`)
- `airbyte/cron`
- `airbyte/server`
- `airbyte/worker`
- `airbyte/workload-launcher`
- `airbyte/workload-api-server`

All share `PRETTY_NAME="Amazon Linux 2"` / `SUPPORT_END="2026-06-30"` (confirmed for cron, server, worker, workload-launcher).

### Vulnerability evidence — `airbyte/cron:2.1.0` (Trivy)

| Source | CRITICAL | HIGH | MEDIUM | LOW |
|---|---|---|---|---|
| OS packages (Amazon Linux 2) | 0 | 62 | 46 | 5 |
| Bundled JARs (application) | 2 | 16 | 15 | 2 |

**CRITICAL (bundled Java agents):**
- `CVE-2026-33728` — `com.datadoghq:dd-java-agent` 1.51.1 → fixed in **1.60.3**
- `CVE-2026-33701` — `io.opentelemetry.javaagent:opentelemetry-javaagent` 2.17.1 → fixed in **2.26.1**

**Representative OS HIGHs (have AL2 patches the image wasn't rebuilt against — unpatchable after EOL):**
- `openssl-libs` 1.0.2k — 12 CVEs (CVE-2026-28388/28389/28390, CVE-2026-34180, CVE-2026-42766, …)
- `python` / `python-libs` 2.7.18 — 11 CVEs (Python 2 is itself EOL and present in the image)
- `glibc` 2.26 (CVE-2026-4046), `libxml2` 2.9.1 (CVE-2025-49794/49796), `libpng` 1.5.13, `libnghttp2`, `vim-minimal`

**Notable application-dependency HIGHs:**
- `io.netty:*` 4.2.9.Final — multiple (codec-http/http2, handler, resolver-dns)
- `org.postgresql:postgresql` 42.7.8 → 42.7.11 (CVE-2026-42198)
- `io.micronaut:micronaut-context` 4.10.18 → 4.10.22

### Impact
64+ HIGH/CRITICAL findings per platform image become **frozen and unpatchable** once AL2 hits EOL on 2026-06-30. Every Airbyte deployment inherits this and cannot remediate without upstream action.

### Requested remediation
1. **Rebase platform images onto a supported base** (Amazon Linux 2023, or a maintained slim/distroless JRE base) — primary ask.
2. Interim: rebuild current releases against latest AL2 ALAS patches before EOL.
3. Bump bundled agents to clear the two CRITICALs: `dd-java-agent` ≥ 1.60.3, `opentelemetry-javaagent` ≥ 2.26.1.
4. Refresh `netty`, `postgresql` JDBC, and `micronaut-context` to fixed versions.

### Relevant log output

```shell
$ docker run --rm --entrypoint sh airbyte/cron:2.1.0 -c 'cat /etc/os-release'
PRETTY_NAME="Amazon Linux 2"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
SUPPORT_END="2026-06-30"

# Latest master build (as of 2026-06-23) is still Amazon Linux 2:
$ docker run --rm --entrypoint sh airbyte/cron:dev-303a200 -c 'grep -E "PRETTY_NAME|SUPPORT_END" /etc/os-release'
PRETTY_NAME="Amazon Linux 2"
SUPPORT_END="2026-06-30"
```

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/12963

Start with the affected images listed in the issue: airbyte/cron, server, worker, workload-launcher, and workload-api-server. Reproduce with the provided docker run /etc/os-release commands and Trivy scan evidence. Done means the platform images use a supported base, the listed Java agents and dependencies are bumped, and scans no longer report the cited frozen EOL findings.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.