The root-module Dependabot update job fails every cycle because ksail is not yet compatible with cilium/ebpf 0.22.0

> 🤖 Generated by the Agentic Engineer

## Evidence

The GitHub-managed Dependabot update job for the **root** Go module fails on every cycle, and it has
now failed on two consecutive runs against `main` — which is what makes it ours to repair rather than
a transient to ignore:

| Run | Head | Result |
|---|---|---|
| 2026-08-19T20:29:00Z | `7376eb6535` | failure |
| 2026-08-19T20:34:19Z | `125114c3f2` | failure |

preceded by a success on 2026-08-17. The updater reports one precise cause:

```
| github.com/cilium/ebpf | pull_request_exists_for_latest_version | dependency-version: 0.22.0 |
```

## The mechanism

Dependabot is trying to raise `github.com/cilium/ebpf` to `0.22.0`, finds that a pull request for
that exact version already exists, and **errors** instead of skipping. The PR it finds is #6589
(`0.21.0` → `0.22.0`), open since 2026-08-17 and `BLOCKED` — it cannot auto-merge because its own CI
is red:

- `🧹 Lint - mega-linter`
- `📊 Code Coverage`
- `🧪 System Test (Docker) (K3s, Docker, true)`
- `🧪 System Test (Docker) (VCluster, Docker, true)`
- `CI - Required Checks`

So this is a self-sustaining loop: the bump cannot land because the code is not yet compatible with
`0.22.0`, and while it cannot land, the update job reports a failure on `main` every cycle.

## Scope — deliberately narrower than it first looks

Only the **ebpf-specific** update job fails. The grouped root-module job covering ebpf alongside the
other bumps succeeded in the same cycle (20:29:02Z), as did every `/desktop` job. This is not a
jammed ecosystem; it is one dependency whose upgrade is blocked on real incompatibility.

## Expected outcome

`ksail` builds and passes its system tests against `github.com/cilium/ebpf` 0.22.0, so the bump can
merge and the managed update job stops reporting red on `main`.

## Acceptance criteria

- [ ] Identify what in the `0.21.0` → `0.22.0` change breaks the build, the two Docker system tests,
and coverage — the four failures should be traced to a cause, not fixed symptomatically.
- [ ] `main` is compatible with `0.22.0`, with the change covered by tests.
- [ ] The Dependabot update job for the root module reports success on the cycle after the bump lands.
- [ ] No `//nolint`, skipped test, or lowered coverage threshold is used to get there.

## Notes

The fix belongs on an agent-owned branch against `main`, not on #6589 — that PR is automation-owned
and must not be pushed to, rebased, or merged by hand. Once `main` is compatible, Dependabot's own
PR should go green and merge through its normal path.

Start at the root Go module's 0.21.0 to 0.22.0 dependency change and reproduce the four failing checks: mega-linter, coverage, and the Docker system tests for K3s and VCluster. Trace the incompatibility to its cause, add or update tests without suppressions, and verify that main passes these checks so the next Dependabot cycle succeeds.

Written by the indexing model from the issue text.