[thxCode]

What type of PR is this?

/kind enhancement
/area worker
/area testing

What this PR does / why we need it:

Upgrades the six bundled CLI tools in pack/gpustack-operator/Dockerfile, updates the default Instance SSH server image to the published Go 1.27.3 image, and isolates make test chart's kubeconfig input:

• Bundled operator image tools (pack/gpustack-operator/Dockerfile, hack/lib/helm.sh):
  • skopeo 1.22.0 -> 1.24.1 (cloned from canonical https://github.com/podman-container-tools/skopeo)
  • helm 3.21.0 -> 3.21.4 (aligned across pack/gpustack-operator/Dockerfile, hack/lib/helm.sh, and .agents/skills/gpustack-operator-chart-subcharts-manage/SKILL.md)
  • vals 0.44.0 -> 0.50.0
  • kustomize 5.8.1 -> 5.8.3
  • ytt 0.54.0 -> 0.55.4
  • kubectl 1.35.3 -> 1.36.5
• Default SSH server image (pkg/worker/settings/value.go, docs/reference/settings.md):
  • Updates InstanceImageSSHServer default from gpustack/ssh-server:v1.3.0 to gpustack/ssh-server:v1.4.0 (sha256:23706a2498b07cf6b1e7f296ae28fe11a38e753832b0d178fdfab39a6ab39b1f, built with Go 1.27.3 / Alpine 3.24.3 in build(ssh-server): use go 1.27.3 and alpine 3.24.3 #787 / test(ssh-server): wait for smoke prerequisites #790).
• Isolated chart test kubeconfig (hack/lib/helm.sh, hack/check/helm-chart-test-selftest.sh):
  • gpustack::helm::test resolves a non-empty single-file KUBECONFIG (or falls back to ${HOME}/.kube/config), rejects path lists, missing paths, and non-regular files before invoking Docker, resolves relative paths to absolute host paths, and bind-mounts the file read-only (:ro) without mutating the caller's configuration.
• Pin-consistency and kubeconfig self-tests (hack/check/toolpins-selftest.sh, hack/check/helm-chart-test-selftest.sh, hack/lint.sh, hack/check/hook-dispatch.sh):
  • Adds bidirectional drift checks for Dockerfile tool pins, Helm helper version comments, and the InstanceImageSSHServer documentation default, plus fixture/mutation tests for gpustack::helm::test::kubeconfig.

Which issue(s) this PR links to:

Relates #787
Relates #790
Relates #794

Special notes for your reviewer:

• Verified native linux/arm64 and linux/amd64 operator image builds and all 15 tool/invocation contracts inside the built images, bash hack/check/toolpins-selftest.sh ., bash hack/check/helm-chart-test-selftest.sh ., make lint, make lint docs, and make test chart against an isolated kubeconfig on Kubernetes v1.36.1.

Does this PR introduce a user-facing change?

NONE

[gpustack-code-review]

✅ OpenCodeReview: Review complete: 0 finding(s) across 5 selected item(s).