ci: run CI and e2e on ubuntu-26.04, with infra-e2e importing kind images per platform

Docker 29 (ubuntu-26.04 runners) uses the containerd image store, where a
pulled multi-platform image holds only the host platform; importing every
platform into kind failed for the OAP image ("content digest ... not
found"). Saved for one platform, the archive also lists the image's
referrers, such as attestations, at its top level, and the containerd 1.7
kindest/node:v1.28.15 these cases pin imports each one as an image, which
failed for the Rover image ("mismatched image rootfs and manifest layers").
infra-e2e now saves only the node platform and leaves the referrers out of
the archive (apache/skywalking-infra-e2e#150, #151), so the e2e cases leave
the ubuntu-24.04 pin #205 added.

The CI and e2e jobs name ubuntu-26.04 rather than ubuntu-latest:
ubuntu-latest jobs sat queued with no runner while jobs naming ubuntu-24.04
or ubuntu-26.04 started within seconds.

The istio mesh spec accepts `UNKNOWN` as the service the MESH header opens
on. Since the e2e OAP pin moved past apache/skywalking#14135 (#204), OAP
reads the Kubernetes metadata of a new pod address in the background, so
bookinfo's first calls count under `UNKNOWN`; in the first minute of traffic
that burst can rank first by calls per minute, and the header then picks
it. It failed so on main at ed6171d (ubuntu-24.04) as well as here.

Author: wu-sheng

.github/workflows/ci.yaml

@@ -32,7 +32,7 @@ jobs:
     # container action that would otherwise sit behind the toolchain setup the
     # build job spends its first half-minute on.
     name: License header
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
@@ -48,7 +48,7 @@ jobs:
     # the setup cost eight times over. Steps run cheapest-first so a lint or
     # type error reports before the package build starts.
     name: Build and check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
@@ -252,7 +252,7 @@ jobs:
     # `test/e2e/script/env` pins, on an ephemeral port, and stops it after. No
     # service container to declare and no port to collide with.
     name: BanyanDB client IT
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
@@ -278,7 +278,7 @@ jobs:
     if: always() && !cancelled()
     name: Required
     needs: [license-header, build-and-check, banyandb-client-it]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Check upstream jobs

.github/workflows/e2e.yaml

@@ -225,10 +225,7 @@ concurrency:
 jobs:
   e2e:
     name: ${{ matrix.case.name }}
-    # Not ubuntu-latest: on ubuntu-26.04, kind cannot load the multi-platform
-    # OAP image into its node (`ctr images import --all-platforms`: content
-    # digest not found), so the kind cases fail before any test runs.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     strategy:
       # One case failing must not cancel the others: when several go red at
@@ -292,7 +289,7 @@ jobs:
         run: make -C test/e2e images
 
       - name: ${{ matrix.case.name }}
-        uses: apache/skywalking-infra-e2e@68bbdec303cf2d3df9f2353f970f91938b52f674
+        uses: apache/skywalking-infra-e2e@ed91851a723f7d09e99742f28835ee91758e0c2b
         with:
           e2e-file: $GITHUB_WORKSPACE/${{ matrix.case.config }}
           # Container logs land here. On a red run they answer the first
@@ -330,7 +327,7 @@ jobs:
     name: E2E Required
     if: always() && !cancelled()
     needs: [e2e]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Assert every case passed
         run: |

test/e2e/playwright/specs/fixture.ts

@@ -135,9 +135,12 @@ export const MESH_LAYER = 'mesh';
 export const MESH_PEERS = ['productpage', 'reviews', 'details'];
 
 /**
- * EVERY service this fixture's mesh can produce: all four bookinfo workloads
- * plus the ingress gateway bookinfo is reached through, which ALS reports
- * like any other mesh workload.
+ * EVERY service this fixture's mesh can produce: all four bookinfo workloads,
+ * the ingress gateway bookinfo is reached through, which ALS reports like any
+ * other mesh workload, and `UNKNOWN`. OAP reads the Kubernetes metadata of a
+ * new pod address in the background rather than waiting for it
+ * (apache/skywalking#14135), so bookinfo's first calls count under `UNKNOWN`,
+ * and in the first minute of traffic that burst can rank above every workload.
  *
  * Distinct from MESH_PEERS on purpose. `ratings` is reached only via
  * reviews-v2/v3, so whether it exists in a given window depends on which
@@ -146,7 +149,7 @@ export const MESH_PEERS = ['productpage', 'reviews', 'details'];
  * follows OAP's ordering and changes between runs, so anything asserting on
  * the SELECTED service must accept the full set.
  */
-export const MESH_SERVICES = [...MESH_PEERS, 'ratings', 'istio-ingressgateway'];
+export const MESH_SERVICES = [...MESH_PEERS, 'ratings', 'istio-ingressgateway', 'UNKNOWN'];
 
 /**
  * The SAME workload in the MESH_DP layer, which names services