fix: repair CNI matrix update from Dependabot #2145

[MaxRink]

Summary

This draft is a follow-up to Dependabot PR #2145. It does not modify or close that PR.

Failures and root causes

• update-kubernetes-version-matrix failed in run 32497795709, job 96820250702 because Dependabot rewrote the source-free release-1-32 tracking go.mod from its generated require block to only go 1.26.3. The matrix synchronizer therefore reported all five tracked modules missing. This is a malformed tracking-manifest update, not a problem with CNI v1.6.2.
• pull-ova-all independently failed for Photon 5 in Prow job 2090828391459590144. The artifact log shows setup : Perform a tdnf distro-sync failing with rc 86 because the Broadcom Photon repository returned HTTP 404 for findutils-4.9.0-7.ph5.x86_64.rpm. The same job failed in sibling PR dependabot(deps): bump github.com/containernetworking/plugins from 1.6.0 to 1.6.2 in /images/capi/packer/config/kubernetes-version-dependencies/release-1-33 #2146 with a different Photon RPM 404, and the URLs return 200 now, so this is an external repository publication/mirror race. No Photon source change is included here.

Fix

• Restore the generated release-1-32 tracking manifest and apply the intended github.com/containernetworking/plugins v1.6.0 -> v1.6.2 update without changing the Go directive or dropping the other tracked modules.
• Keep the upstream CNI tarball version independent from the Kubernetes package repository version. Kubernetes 1.32 currently publishes kubernetes-cni 1.6.0 in its DEB/RPM repositories, so package-based targets continue using 1.6.0 while URL-based targets use the requested v1.6.2 tarball.
• Regenerate the canonical matrix and document the intentional distinction.

Validation

• python3 images/capi/hack/kubernetes-version-matrix.py sync-tracking --write
• python3 images/capi/hack/kubernetes-version-matrix.py verify
• Rendered 1.32 matrix check: CNI tarball v1.6.2, DEB/RPM package 1.6.0 / 1.6.0-1.1
• Parsed the generated YAML with yq and ran git diff --check

The vSphere OVA job requires the Prow/vSphere environment and is not run locally; its Photon failure is unrelated to this matrix fix.

[kubernetes-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign averagemarcus for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: MaxRink / name: Maximilian Rink (5bc5dad)

[MaxRink]

/test all