test: validate current Amazon kernels

[ErenAri]

Summary

Adds Amazon Linux as an exact kernel-install family for generated kernel sweeps.

• AL2 installs the exact signed kernel-<release> package with yum
• AL2023 installs the exact signed package with dnf --releasever=latest, bypassing the cloud image deterministic repository lock only for this disposable validation guest
• both select the exact /boot/vmlinuz-<release> with grubby, reboot, verify exact uname -r, then run validation
• generated current profiles cover AL2 5.10.260-259.1061 and AL2023 6.1.177-224.371
• the enterprise refresh matrix now exercises those exact kernels
• freshness reports both lagging stock-image baselines as covered, with zero stale profiles

Why

The newest public Amazon KVM images lag the newest signed kernel packages. Testing only the image kernel left two honest stale results. This closes that gap without claiming unbooted bytes and without depending on non-browsable RPM blob URLs.

Release boundary

Draft intentionally. This changes the supported VM executor boundary and should merge after the active v0.4 graduation window, unless the maintainer explicitly chooses to reset that evidence window. No tracking issue is needed.

Real KVM evidence

• AL2: exact uname 5.10.260-259.1061.amzn2.x86_64; load pass; required attach pass; execve trace event pass; report SHA-256 4587cd265b851d4972a227e6fdfaa097c4339ba6c2504d6e733f2c0b00d85d4d
• AL2023: exact uname 6.1.177-224.371.amzn2023.x86_64; load pass; required attach pass; execve trace event pass; report SHA-256 ba5914985f15330a427715126f744e91c4bdeb9a79c9cebd335372bc3a626e58
• live kernel-crawler freshness: 0 stale profiles of 57 checked

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run --timeout=5m --new-from-rev=origin/main
• govulncheck ./...
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
• generated docs consistency and profile catalog audit
• release consistency and git diff --check