[hallvictoria]

Description

• Enable CFS network isolation for official builds
• Update R2P2 packaging to use published runtime packages and stable Python 3.15
• Support major.minor versions in ARM64 builds and use pipeline-staged CPython archives (R2P2)
• Pin GitHub Actions to full commit SHAs and add Dependabot cooldown

Fixes #

---

Pull Request Checklist

Host-Worker Contract

• Does this PR impact the host-worker contract (e.g., gRPC messages, shared interfaces)?
  • If yes, have the changes been applied to:
    • azure_functions_worker (Python <= 3.12)
    • proxy_worker (Python 3.13-3.14)
    • r2p2 (Python >= 3.15)
  • If no, please explain why:

Worker Execution Logic

• Does this PR affect worker execution logic (e.g., function invocation, bindings, lifecycle)?
  If yes, please answer the following:

Python Version Coverage

• Does this change apply to all supported worker models?
• If yes, have the changes been made to:
  • azure_functions_worker (Python <= 3.12)
  • proxy_worker (Python 3.13-3.14)
  • r2p2 (Python >= 3.15)
  • runtimes/v1 / runtimes/v2 (Python >= 3.13)
• If no, please explain why:

Programming Model Compatibility (proxy_worker and r2p2)

• Does this change apply to both:
  • V1 programming model (runtimes/v1)?
  • V2 programming model (runtimes/v2)?
• Explanation (if limited to one model):