Merge pull request #12852 from tanyifeng:net-ip-mtu-discover

Merge pull request #12813 from tanyifeng:add-dev-block-char

Add initial AI tool use policy for gVisor.

Merge pull request #12814 from tanyifeng:proc-randomize-va-space

Allow sub-containers to cold-start on restored Pods.

proc: Add /proc/sys/kernel/randomize_va_space

runsc: accept nvidia-cdi-hook

Merge pull request #12853 from tanyifeng:vfs-ficlone-eopnotsupp

gVisor security policy: Clarifications and update for `InternalEsc`.

vfs: return EOPNOTSUPP for FICLONE/FICLONERANGE/FIDEDUPERANGE

net: Support all valid IP_MTU_DISCOVER values for UDP and TCP

mm: only hugepage-align mappings of hugepage-aligned length

Merge pull request #12634 from pawannn:master

Read runsc.Options from the state file to clean up task service.

Add support for STATX_MNT_ID in statx.