ci(pr): PR pipeline → ubuntu-26.04 + distro Meson

.github/workflows/lint-pr.yml

@@ -24,7 +24,7 @@ jobs:
   # ==========================================================================
   editorconfig-check:
     name: EditorConfig check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v5
 
@@ -65,7 +65,7 @@ jobs:
   uncrustify-check:
     name: uncrustify check
     needs: [editorconfig-check]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v5
         with:

docs/RELEASE_PROCESS.md

@@ -417,22 +417,22 @@ the cutover commit sets `project_version` to `1.0.0-rc1`.
 - Tag protection on `v1.x.*`.
 - Required status checks:
   - Stable policy plan: `default`, `abi`, `asan`, `tsan`, `perf`,
-    plus `mbedtls-enabled / ubuntu-latest / gcc`.
+    plus `mbedtls-enabled / ubuntu-26.04 / gcc`.
   - `perf` must be represented by a dedicated always-emitting release
     perf context that runs with `WIRELOG_PERF_REQUIRE=1`; do not rely on
     path-filtered contexts for branch protection.
   - Currently known concrete PR contexts to require at cutover (unless
     replaced by a later policy-consolidation change): `lint / EditorConfig check`,
     `lint / uncrustify check`,
-    `Build / ubuntu-latest / gcc`, `Build / ubuntu-24.04-arm / gcc`,
+    `Build / ubuntu-26.04 / gcc`, `Build / ubuntu-26.04-arm / gcc`,
     `RC changelog freeze gate`, `CLA signoff gate`,
-    `mbedtls-enabled / ubuntu-latest / gcc`,
-    `Build / ubuntu-latest / clang`, `Build / macos-latest / clang`,
+    `mbedtls-enabled / ubuntu-26.04 / gcc`,
+    `Build / ubuntu-26.04 / clang`, `Build / macos-latest / clang`,
     `Build / windows-latest / msvc`,
-    `Sanitizers / ubuntu-latest / gcc`,
-    `Sanitizers / ubuntu-latest / clang`,
+    `Sanitizers / ubuntu-26.04 / gcc`,
+    `Sanitizers / ubuntu-26.04 / clang`,
     `Sanitizers / macos-latest / clang`,
-    `TSan / ubuntu-latest / gcc`.
+    `TSan / ubuntu-26.04 / gcc`.
 
 #### Synthetic PR verification plan (Phase B)
 
@@ -488,7 +488,7 @@ separate policy change.
 ### mbedTLS-enabled validation policy
 
 The stable check name for optional crypto validation is
-`mbedtls-enabled / ubuntu-latest / gcc`.  The check is validation
+`mbedtls-enabled / ubuntu-26.04 / gcc`.  The check is validation
 coverage only: it proves that `-DmbedTLS=enabled` still configures,
 builds, and runs the crypto tests against a system PSA Crypto provider.
 It does **not** change the default release artifact posture, which

sbom/snapshot.txt

@@ -9,7 +9,6 @@
 ./.github/actions/setup-meson@UNKNOWN:NOASSERTION
 ./.github/actions/setup-meson@UNKNOWN:NOASSERTION
 ./.github/actions/setup-meson@UNKNOWN:NOASSERTION
-./.github/actions/setup-meson@UNKNOWN:NOASSERTION
 ./.github/workflows/fuzz-evidence-shard.yml@UNKNOWN:NOASSERTION
 ./.github/workflows/lint-main.yml@UNKNOWN:NOASSERTION
 ./.github/workflows/lint-pr.yml@UNKNOWN:NOASSERTION

scripts/ci/check-clang-tidy-ratchet.py

@@ -42,7 +42,7 @@
     command line.
 
 The architecture guard is not redundant with the OS one: `build-arm`
-(`.github/workflows/ci-pr.yml`, ubuntu-24.04-arm) is Linux, uninstrumented
+(`.github/workflows/ci-pr.yml`, ubuntu-26.04-arm) is Linux, uninstrumented
 and not MSVC, and runs an unfiltered `meson test`.  It is protected today
 only by clang-tidy 22 being absent from that image, which is an accident of
 the runner rather than a guarantee.  `clang-analyzer-*` results are

scripts/ci/ci-telemetry-fixtures/run-clock-skew-jobs.json

@@ -6,7 +6,7 @@
       "created_at": "2026-09-11T08:33:37Z",
       "id": 103200409721,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "RC changelog freeze gate",
       "runner_group_name": "default",
@@ -62,7 +62,7 @@
       "created_at": "2026-09-11T08:33:37Z",
       "id": 103200409951,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Detect build-triggering changes",
       "runner_group_name": "GitHub Actions",
@@ -118,7 +118,7 @@
       "created_at": "2026-09-11T08:33:37Z",
       "id": 103200409955,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Docs / policy validation",
       "runner_group_name": "default",
@@ -174,7 +174,7 @@
       "created_at": "2026-09-11T08:35:15Z",
       "id": 103200838630,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "lint / EditorConfig check",
       "runner_group_name": "GitHub Actions",
@@ -246,7 +246,7 @@
       "created_at": "2026-09-11T08:43:11Z",
       "id": 103202876645,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "lint / uncrustify check",
       "runner_group_name": "default",

scripts/ci/ci-telemetry-fixtures/run-missing-data-jobs.json

@@ -6,7 +6,7 @@
       "created_at": "2026-09-10T10:00:01Z",
       "id": 301,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Detect build-triggering changes",
       "runner_group_name": "GitHub Actions",
@@ -21,9 +21,9 @@
       "created_at": "2026-09-10T10:00:11Z",
       "id": 302,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "Build / ubuntu-latest / gcc",
+      "name": "Build / ubuntu-26.04 / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1",
       "started_at": null,
@@ -45,9 +45,9 @@
       "created_at": "2026-09-10T10:02:00Z",
       "id": 303,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "TSan / ubuntu-latest / gcc",
+      "name": "TSan / ubuntu-26.04 / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1",
       "started_at": "2026-09-10T10:02:05Z",

scripts/ci/ci-telemetry-fixtures/run-queued-jobs.json

@@ -6,7 +6,7 @@
       "created_at": "2026-09-10T10:00:01Z",
       "id": 201,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Detect build-triggering changes",
       "runner_group_name": "GitHub Actions",
@@ -54,9 +54,9 @@
       "created_at": "2026-09-10T10:00:18Z",
       "id": 202,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "Build / ubuntu-latest / gcc",
+      "name": "Build / ubuntu-26.04 / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1",
       "started_at": "2026-09-10T10:00:30Z",
@@ -94,9 +94,9 @@
       "created_at": "2026-09-10T10:00:18Z",
       "id": 203,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "TSan / ubuntu-latest / gcc",
+      "name": "TSan / ubuntu-26.04 / gcc",
       "runner_group_name": null,
       "runner_name": null,
       "started_at": null,

scripts/ci/ci-telemetry-fixtures/run-rerun-jobs.json

@@ -6,7 +6,7 @@
       "created_at": "2026-09-10T10:00:01Z",
       "id": 401,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Detect build-triggering changes",
       "runner_group_name": "GitHub Actions",

scripts/ci/ci-telemetry-fixtures/run-skip-cascade-jobs.json

@@ -6,7 +6,7 @@
       "created_at": "2026-09-11T06:49:48Z",
       "id": 103174726297,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Detect build-triggering changes",
       "runner_group_name": "GitHub Actions",
@@ -62,7 +62,7 @@
       "created_at": "2026-09-11T06:49:48Z",
       "id": 103174726522,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "Docs / policy validation",
       "runner_group_name": "default",
@@ -118,7 +118,7 @@
       "created_at": "2026-09-11T06:49:48Z",
       "id": 103174726533,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "RC changelog freeze gate",
       "runner_group_name": "default",
@@ -174,7 +174,7 @@
       "created_at": "2026-09-11T06:50:17Z",
       "id": 103174840940,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "lint / EditorConfig check",
       "runner_group_name": "default",
@@ -246,7 +246,7 @@
       "created_at": "2026-09-11T06:50:36Z",
       "id": 103174910112,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
       "name": "lint / uncrustify check",
       "runner_group_name": "GitHub Actions",
@@ -326,9 +326,9 @@
       "created_at": "2026-09-11T06:50:52Z",
       "id": 103174971848,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "Sanitizers / ubuntu-latest / clang",
+      "name": "Sanitizers / ubuntu-26.04 / clang",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1000055705",
       "started_at": "2026-09-11T06:50:54Z",
@@ -438,9 +438,9 @@
       "created_at": "2026-09-11T06:50:52Z",
       "id": 103174971875,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "Build / ubuntu-latest / gcc",
+      "name": "Build / ubuntu-26.04 / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1000055706",
       "started_at": "2026-09-11T06:50:55Z",
@@ -582,9 +582,9 @@
       "created_at": "2026-09-11T06:50:52Z",
       "id": 103174971879,
       "labels": [
-        "ubuntu-24.04-arm"
+        "ubuntu-26.04-arm"
       ],
-      "name": "Sanitizers / ubuntu-24.04-arm / gcc",
+      "name": "Sanitizers / ubuntu-26.04-arm / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1000055708",
       "started_at": "2026-09-11T06:50:57Z",
@@ -694,9 +694,9 @@
       "created_at": "2026-09-11T06:50:52Z",
       "id": 103174971902,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "Sanitizers / ubuntu-latest / gcc",
+      "name": "Sanitizers / ubuntu-26.04 / gcc",
       "runner_group_name": "GitHub Actions",
       "runner_name": "GitHub Actions 1000055707",
       "started_at": "2026-09-11T06:50:55Z",
@@ -918,9 +918,9 @@
       "created_at": "2026-09-11T07:14:47Z",
       "id": 103180567746,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "mbedtls-enabled / ubuntu-latest / gcc",
+      "name": "mbedtls-enabled / ubuntu-26.04 / gcc",
       "runner_group_name": null,
       "runner_name": null,
       "started_at": "2026-09-11T07:14:47Z",
@@ -933,9 +933,9 @@
       "created_at": "2026-09-11T07:14:47Z",
       "id": 103180567967,
       "labels": [
-        "ubuntu-24.04-arm"
+        "ubuntu-26.04-arm"
       ],
-      "name": "Build / ubuntu-24.04-arm / gcc",
+      "name": "Build / ubuntu-26.04-arm / gcc",
       "runner_group_name": null,
       "runner_name": null,
       "started_at": "2026-09-11T07:14:47Z",
@@ -961,9 +961,9 @@
       "created_at": "2026-09-11T07:34:52Z",
       "id": 103185485539,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "TSan / ubuntu-latest / ${{ matrix.compiler }}",
+      "name": "TSan / ubuntu-26.04 / ${{ matrix.compiler }}",
       "runner_group_name": null,
       "runner_name": null,
       "started_at": "2026-09-11T07:34:52Z",
@@ -976,9 +976,9 @@
       "created_at": "2026-09-11T07:34:52Z",
       "id": 103185485852,
       "labels": [
-        "ubuntu-latest"
+        "ubuntu-26.04"
       ],
-      "name": "TSan-native / ubuntu-latest / gcc",
+      "name": "TSan-native / ubuntu-26.04 / gcc",
       "runner_group_name": null,
       "runner_name": null,
       "started_at": "2026-09-11T07:34:52Z",