chore(deps): update runc-containerd-ca_watcher (patch)

[renovate]

This PR contains the following updates:

Package	Update	Change
moby-runc	patch	1.4.1-ubuntu20.04u1 → 1.4.3-ubuntu20.04u1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[awesomenix]

this causes break in ubuntu 2004

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168686319
Failed job/stage/task: $(System.Collections.Hashtable.job)
First failing step/test: $(System.Collections.Hashtable.first)

RCA: This is the recurring NetworkIsolated shared-cluster cleanup flake. E2E found existing cluster abe2e-azure-networkisolated-v3-d6cc9 already Deleting/Failed and failed before PR-specific scenario validation. Prior evidence for the same cluster shows ResourceGroupDeletionBlocked / InUseNetworkSecurityGroupCannotBeDeleted on the shared NetworkIsolated NSG.

Confidence: High. Checked timeline/status, focused failed log, associated changes, and known wiki signatures before publishing.

Strongest alternative: the Renovate runc/containerd ca_watcher payload caused node/image behavior. Less likely because failure occurs while acquiring a pre-existing shared cluster.

Recommended owner/action: AgentBaker E2E test-infra owner: clean/quarantine abe2e-azure-networkisolated-v3-d6cc9 and harden cleanup/retry.

Wiki signature: $(System.Collections.Hashtable.sig) (source of truth)

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=168677539
Failed job/stage/task: Run AgentBaker E2E
First failing step/test: $(System.Collections.Hashtable.first)

RCA: This is the recurring NetworkIsolated shared-cluster cleanup flake. E2E found existing cluster �be2e-azure-networkisolated-v3-d6cc9 already Failed/Deleting and failed before PR-specific scenario validation. Prior evidence for this same cluster shows ResourceGroupDeletionBlocked / InUseNetworkSecurityGroupCannotBeDeleted on �be2e-networkisolated-securityGroup still attached to the shared VNET subnet.

Confidence: High. Corroborated by timeline/status, Run AgentBaker E2E log 538, unrelated PRs hitting the same cluster/signature, and the existing repair item #38506740.

Strongest alternative: the runc/containerd ca_watcher Renovate payload caused node/image behavior; less likely because the failure is while acquiring a pre-existing shared cluster already in bad lifecycle state.

Recommended owner/action: AgentBaker E2E test-infra owner: clean/quarantine �be2e-azure-networkisolated-v3-d6cc9, remove the stuck NSG/subnet association, and harden shared-cluster cleanup/retry.

Wiki signature:
etworkisolated-shared-cluster-delete-blocked-inuse-nsg (source of truth)