Test CI on Ubuntu 26.04

.github/workflows/api-compat-noop.yml

@@ -36,7 +36,7 @@ permissions:
 jobs:
   crd-schema-check:
     name: CRD Schema Compatibility
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 2
     steps:
       - name: No API surface changes

.github/workflows/api-compat.yml

@@ -44,7 +44,7 @@ permissions:
 jobs:
   crd-schema-check:
     name: CRD Schema Compatibility
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # Skip the check entirely when `api-break-allowed` is applied — a
     # required check that is skipped (rather than failed) counts as passing
     # for branch protection, so this is the escape hatch for intentional

.github/workflows/e2e-tests.yml

@@ -57,7 +57,7 @@ jobs:
             label_filter: core
             artifact: e2e-test-results-core
             procs: 4
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: mcp-run
             label_filter: mcp-run
             artifact: e2e-test-results-mcp-run
@@ -77,31 +77,31 @@ jobs:
           - title: api-registry
             label_filter: api-registry
             artifact: e2e-test-results-api-registry
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-workloads
             label_filter: "api-workloads && !lifecycle"
             artifact: e2e-test-results-api-workloads
             test_timeout: 25m
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-workloads-lifecycle
             label_filter: "api-workloads && lifecycle"
             artifact: e2e-test-results-api-workloads-lifecycle
             test_timeout: 25m
           - title: api-clients
             label_filter: api-clients
             artifact: e2e-test-results-api-clients
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-misc
             label_filter: api-misc
             artifact: e2e-test-results-api-misc
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: vmcp
             label_filter: vmcp
             artifact: e2e-test-results-vmcp
           - title: llm
             label_filter: llm
             artifact: e2e-test-results-llm
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -208,7 +208,7 @@ jobs:
   conformance:
     name: MCP Conformance
     # Runs for about a minute; the standard runner is free for this public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: build-binary
     timeout-minutes: 20
     strategy:

.github/workflows/license-headers.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   check-license-headers:
     name: Check License Headers
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/lint.yml

@@ -12,7 +12,7 @@ jobs:
     # golangci-lint itself runs for well under a minute here; the job is
     # dominated by checkout, toolchain setup and cache restore, none of which
     # scale with cores. The standard runner is free for this public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/operator-ci.yml

@@ -12,7 +12,7 @@ jobs:
     name: Operator Tests
     # Short, setup-dominated job; the standard runner is free for this
     # public repo. Integration and E2E jobs below keep the large runner.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -60,7 +60,7 @@ jobs:
     name: Build Operator
     # Short, setup-dominated job; the standard runner is free for this
     # public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -83,7 +83,7 @@ jobs:
 
   generate-crds:
     name: Generate CRDs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -118,7 +118,7 @@ jobs:
 
   generate-crd-docs:
     name: Generate CRD Docs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/security-scan.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   grype-repo-scan:
     name: Grype Repository Scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write
@@ -53,7 +53,7 @@ jobs:
 
   zizmor:
     name: GitHub Actions Static Analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write
@@ -98,7 +98,7 @@ jobs:
 
   govulncheck:
     name: Go Vulnerability Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/skills-build.yml

@@ -35,7 +35,7 @@ on:
 jobs:
   skills-build:
     name: Build Skills
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
 

.github/workflows/spellcheck.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   codespell:
     name: Codespell
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -20,4 +20,4 @@ jobs:
         with:
           skip: .git
           check_filenames: true
-          check_hidden: true
+          check_hidden: true

.github/workflows/verify-gen.yml

@@ -9,7 +9,7 @@ permissions:
 jobs:
   verify-code-generation:
     name: Verify Code Generation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7