[Code-Hex]

Why

Update the pinned kernel from Linux 6.18.3 to stable 7.2.9 while retaining the small aarch64 and x86_64 VM images. The fixed v6.x download path cannot fetch a 7.x kernel, and config updates previously hid failures.

Scope

• Derive the download directory from the kernel major version and regenerate both minimal configs without adding drivers.
• Make -u prepare dependencies, use target compilers, run non-interactively, and propagate failures.
• Select target tools by absolute path, repair native binutils aliases, and pass target compiler/build/host information to userspace configure scripts.
• Add executable build/VM checks under tests/ and parallel GitHub Actions jobs running directly on Ubuntu 26.04, with cached toolchains and incremental kernel builds. Preserve archive layout and guest interfaces.

Verification

The workflow runs bash tests/run.sh <architecture> directly on Ubuntu 26.04 runners, one job per architecture. It checks config stability and failure handling, builds both images, and boots the resulting archives with QEMU TCG and 256 MiB RAM. Guest checks cover DHCP, password SSH login, virtiofs read/write and read-only enforcement, console/RNG devices, SSH banners over default/custom vsock ports, and guest poweroff.

See tests/README.md for native setup and commands. Logs are uploaded even on failure; image artifacts are uploaded only after checks pass. Toolchains and kernel build directories are cached using the build script, configs, and toolchain checksums as the key. Every run still rebuilds userspace, packages the images, and executes all checks.

Both architectures passed on commit 03a9e0b:

Run	aarch64 job	x86_64 job	Parallel wall time
Cold native run	11m29s	10m16s	11m30s
Warm native run	3m06s	2m19s	3m06s

The previous sequential container run took 23m42s. These are single-run observations including job setup, dependencies, cache handling, checks, and artifact uploads, excluding queue time. Warm logs confirm exact cache hits for both architectures and incremental kernel compilation. All config and VM checks passed in both runs. Native local x86_64 VM checks also passed.

Missing toolchains come from a pinned GitHub mirror with SHA-256 checks because musl.cc blocks Actions traffic. Apple Virtualization Framework, host-requested shutdown, and aarch64 build hosts are not covered.

The Actions references are pinned to checkout v6.1.0, cache v6.1.0, and upload-artifact v6.0.0. CI passed on the updated commit 4cbae1e for both architectures.