Move ARM64 Helix container hosts to Azure Linux 4 - #136387

<!-- -->

## Summary

Prepare the **H2 ARM32 host-only candidate** from
[#136313](#136313), following
the native ARM64 container-host changes merged in
[#136387](#136387).

Change only the host component `AzureLinux.3.Arm64[.Open]` to
`AzureLinux.4.Arm64[.Open]` for existing Debian 13 and Alpine 3.24 ARM32
containers:

| File | Host mappings |
|---|---:|
| `eng/pipelines/coreclr/templates/helix-queues-setup.yml` | 4 |
| `eng/pipelines/libraries/helix-queues-setup.yml` | 1 |
| `eng/pipelines/installer/helix-queues-setup.yml` | 1 |
| `eng/pipelines/helix-platforms.yml` | 8 |

The 14 replacements comprise eight Debian and six Alpine mappings, with
eight public and six internal queue strings. Parenthesized aliases,
public/internal routing, image tags, all six digest pins, existing
tag-only aliases, payload architectures, ABI/sysroots, cross-build
inputs, conditions, queue groups and lane counts are unchanged. All 11
native ARM64 container-host mappings from #136387, both bare AL3 ARM64
VM entries, other platforms, build agents and SuperPMI are preserved.

This is not an ARM32 image upgrade, distro-coverage change, test
conversion to ARM64, or host-tooling/provisioning change. It does not
close #136313 or declare H2, S1 or S2 complete.

## Compatibility status and merge requirement

**Actual ARM32 execution on the deployed Azure Linux 4 ARM64 Helix hosts
is unverified. This is a candidate, not a proven-compatible deployment.
Do not merge based on static checks or ARM64 queue availability alone.**

Read-only [Helix queue
metadata](https://helix.dot.net/api/2019-06-17/info/queues) advertises
gallery image `MicrosoftAzureLinux/azurelinux-4/4-arm64/4.0.2026091402`
and an ARM64 Alpine smoke image. The exposed artifact metadata does not
establish ARM32 execution or installed QEMU/binfmt support.

The [upstream AL4 kernel
configuration](https://github.com/microsoft/azurelinux/blob/1035368c970cbed17ab06a8006b6c57b25fdc856/specs/k/kernel/6.18-aarch64-azl.config#L527)
enables compat ELF support, but that is not proof of the deployed
kernel, CPU AArch32 EL0 capability, or emulation setup. Native execution
requires suitable CPU/kernel support; otherwise transparent execution
requires an already-provisioned emulator and appropriate binfmt
registration/interpreter access. No such configuration is changed here.

A bounded sample of 100 recent public ARM32 Helix jobs contained no AL4
ARM64 execution. Successful existing [Debian
ARM32](https://helix.dot.net/api/2019-06-17/jobs/b66ca86e-904b-4af4-917c-93f808a1ab67/details)
and [Alpine
ARM32](https://helix.dot.net/api/2019-06-17/jobs/7f9bae7f-55f8-42d4-9e0a-804d67b96323/details)
jobs ran on AL3, not AL4. Neither those passing jobs, kernel
`CONFIG_COMPAT`, native ARM64 success, nor
`Architecture=ARM64`/`IsAvailable=true` establishes ARM32-on-AL4
compatibility. **No concrete incompatibility has been established
either.**

Actual Debian and Alpine ARM32 execution on AL4 hosts is required before
merge. Confirm the resolved host queue, unchanged ARM32 container, and
successfully executed ARM32 workloads, rather than submission-only or
ARM64 results:

- [ ] `runtime`: `build_linux_arm_checked_CoreCLR_ReleaseLibraries` —
Debian ARM32 runtime innerloop, via the CoreCLR queue template
(`eng/pipelines/runtime.yml:663-703`).
- [ ] `runtime`: `build_linux_musl_arm_checked_CoreCLR_ReleaseLibraries`
— Alpine ARM32 libraries on Checked CoreCLR, via the CoreCLR queue
template (`eng/pipelines/runtime.yml:704-743`).
- [ ] `runtime-extra-platforms`: `linux_arm` Release
`Libraries_Release_CoreCLR` — the separately gated Debian ARM32
libraries mapping
(`eng/pipelines/extra-platforms/runtime-extra-platforms-other.yml:15-44`).
Ordinary `runtime` PR validation does not exercise this
libraries-template entry.

These are existing routes, not new lanes. No manual CI trigger/retry or
Helix submission has been performed or is requested by this change; any
manual execution requires separate authorization. Additional existing
coverage includes `runtime-coreclr outerloop` Checked JIT runs with
`platformGroup: all` for both ARM32 platforms, and scheduled libraries
outerloop Debian ARM32 runs with `includeAllPlatforms: true`.

## Coverage gaps

- **Internal queues:** public CI does not validate the internal hosts.
CoreCLR explicitly selects non-`.Open` Debian/Alpine entries; libraries
and installer senders strip `.Open` for internal projects. Those routes
are preserved, but no internal execution evidence was obtained.
`runtime-official.yml` is publication-only, not an ARM32 test route.
- **Installer:** the ARM32 mapping has no current active caller. The
three installer queue-template invocations in `runtime.yml` select other
platforms. Ordinary `runtime` or extra-platforms success cannot validate
ARM32 installer execution.
- **Central aliases:** only `helix_linux_arm32_oldest` has in-repository
consumers: cDAC dump/stress/xplat routes in `runtime-diagnostics`, plus
optional SOS ARM32 selection (excluded from default `sosPlatforms`).
These are not covered by ordinary `runtime`/extra-platforms. The
remaining seven aliases, including all internal and all Alpine ARM32
aliases, have no in-repository consumers.

No coverage expansion or host support installation is included to hide
these gaps. Closing them requires separately approved work; public CI
success must not be described as exercising every changed mapping.

## Validation

- **Passed:** `python3 "$SESSION_FILES/verify-arm32-hosts.py"` using
existing PyYAML 6.0.3. The session-local assertion script checks
duplicate-key-rejecting YAML parsing, parsed structure equality modulo
the permitted host transformation, exact full-file byte equality against
that transformation, all 14 replacements, unchanged payload
alias/image/digest bytes, preservation of all 11 landed native ARM64
mappings and both bare AL3 ARM64 entries, and the absence of unrelated
tracked changes.
- **Passed:** `git diff --check`.
- **Passed:** read-only MCR tag/manifest/config queries confirmed both
existing pinned payloads are `linux/arm/v7`; no Docker commands or image
operations were performed. Existing unpinned aliases remain floating
tags.
- **Not run:** product builds/tests (queue-metadata-only change), Azure
Pipelines template expansion, or actual ARM32 execution on AL4 Helix
hosts. No manual CI/Helix jobs, Docker operations, provisioning,
kernel/binfmt changes, or emulation installation were performed.

See the [OS onboarding
guide](https://github.com/dotnet/runtime/blob/main/docs/project/os-onboarding.md)
for the container-host testing model.

> [!NOTE]
> This pull request description and the code changes were prepared with
GitHub Copilot.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b085338b-95ae-40c2-a1e0-d77e477f5cfc