fix: ship patched guest kernels in system AMIs and the LB microVM (#1222)

build-system-image.sh never upgraded the base cloud image, so every Alpine
system AMI kept the kernel its base image was released with. Run apk upgrade
before installing manifest packages so rebuilt AMIs carry the branch's current
linux-virt (6.18.57-r0 on 3.24, 6.12.113-r0 on 3.21; CVE-2026-99999).

The ELBv2 microVM defaulted to Alpine 3.20, which is EOL and will never get a
fixed kernel. Default to 3.24.

scripts/build-microvm-image.sh

@@ -17,7 +17,7 @@ BUILD_DIR="$REPO_ROOT/build/microvm"
 INIT_SH="$BUILD_DIR/init.sh"
 INITTAB="$BUILD_DIR/inittab"
 
-ALPINE_VERSION="${ALPINE_VERSION:-3.20}"
+ALPINE_VERSION="${ALPINE_VERSION:-3.24}"
 ALPINE_MIRROR="${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}"
 # haproxy: ALB (L7) data plane. nginx + nginx-mod-stream: NLB (L4) data plane —
 # the `stream` module (a separate Alpine package) load-balances TCP/UDP/TLS,

scripts/build-system-image.sh

@@ -284,6 +284,9 @@ if [[ "$DISTRO" == "alpine" ]] && [[ -n "${APK_PACKAGES:-}" ]]; then
     CUST+=(--run-command 'sed -i "s|^#\(.*community\)|\1|" /etc/apk/repositories 2>/dev/null || true')
     CUST+=(--run-command 'grep -q community /etc/apk/repositories || grep main /etc/apk/repositories | head -1 | sed "s|/main|/community|" >> /etc/apk/repositories')
     CUST+=(--run-command 'apk update')
+    # The base cloud image's kernel is only as fresh as its release; upgrade so
+    # the AMI ships the branch's current linux-virt and security fixes.
+    CUST+=(--run-command 'apk upgrade')
     CUST+=(--run-command "apk add ${APK_PACKAGES}")
 elif [[ "$DISTRO" == "ubuntu" ]] && [[ -n "${APT_PACKAGES:-}" ]]; then
     echo "Will install packages: ${APT_PACKAGES}"