Refresh worker dependencies and roll out NICLLS across main and self-managed 1.0.x #2424

Problem

Shared worker dependency updates, the NICLLS image build, and the stack's NICLLS image selection are separate release steps. A dependency change alone does not update the image that a self-managed installation runs. Track the full rollout on main and its backport to the self-managed 1.0.x release line here.

This is a multi-PR maintenance effort. Keep this issue open until both release lines consume and validate the intended published image.

Work breakdown and order

1. Shared dependency PR on main: #2425 (merged)
   • Refresh the worker's gRPC, QUIC, and Go crypto dependencies and required transitive modules.
   • Update the module's minimum Go version where required and validate worker behavior and downstream compilation.
   • Review licenses, generated dependency metadata, and compatibility with the repository's Go workspace.
2. NICLLS producer/build PR
   • Consume the merged shared-worker revision and reconcile direct dependency requirements.
   • Update all compiler/build-image pins to a compatible patched Go release. The proposed crypto dependency requires Go 1.26 or newer.
   • Review other producer dependency and base-image updates as a separate, scoped maintenance change where needed.
   • Build and test linux/amd64 and linux/arm64; publish a new immutable NICLLS version and record its digests and release qualification results.
3. Stack/chart rollout PR on main: #2426 (draft)
   • Bump niclls-container in deploy/helm/cloud-functions/nvcf-api/values.yaml to that published version and update deploy/helm/cloud-functions/tests/sidecar_release_artifacts_test.sh.
   • Release the affected chart, then update its self-managed stack pin and generated release inventory through the normal release process. Split chart and stack changes into separate PRs when publication ordering requires it.
   • Verify rendered image references, registry overrides, mirroring requirements, release metadata, and documentation. Reconcile the existing NICLLS exclusion in the generated image catalog with the supported release and mirroring requirements.
   • Qualify invocation/streaming, worker connectivity, and clean-install and upgrade behavior with the new NICLLS image.
4. Self-managed 1.0.x backport PRs
   • Target release-deploy/stacks/self-managed/v1.0 for the stack release-line changes, not a documentation release branch.
   • Identify the compatible chart/component release branches and backport or adapt the required dependency, producer, chart, and stack changes in dependency order. Reuse the qualified image when compatible; otherwise build and qualify a release-line-compatible image.
   • Keep release-line changes narrowly scoped; do not pull unrelated main features into 1.0.x.
   • Publish a new 1.0.x patch release, preserve previously published tags/images, and update the release inventory, version catalog, compatibility documentation, and release notes through the normal release workflow.
   • Validate an upgrade from a supported existing 1.0.x installation, verify the selected NICLLS image/digests on both architectures, and document rollback.

Completion evidence

• Link every dependency, producer, chart, stack, and backport PR here, with its merge/publication dependency and status.
• Record the final NICLLS version and platform digests, chart versions, main stack release, and self-managed 1.0.x patch release.
• Attach relevant build/test, image qualification, rendered-manifest, install/upgrade, and rollback results.
• Confirm both main and 1.0.x use the intended published image. A shared-library merge or image publication alone does not complete this issue.