[DNM] chore: migrate images to Ubuntu 26.04 (resolute)

[matifali]

Summary

Migrate the images to the newly released Ubuntu 26.04 LTS (resolute). UBUNTU_VERSION in scripts/images.sh is the single source of truth, so the Ubuntu-native images and everything that inherits from them roll forward from one change.

Changes

• scripts/images.sh: UBUNTU_VERSION noble → resolute; added UBUNTU_VERSION_OVERRIDES + ubuntu_version_for helper to pin individual images to a different release.
• images/base/ubuntu.Dockerfile: ARG UBUNTU_VERSION default → resolute
• images/minimal/ubuntu.Dockerfile: ARG UBUNTU_VERSION default → resolute
• images/base/docker.list: Docker apt suite noble → resolute
• README.md: tag examples ubuntu-noble → ubuntu-resolute
• images/universal/ubuntu.Dockerfile: pinned to noble via the override (see note)
• scripts/build_images.sh / scripts/push_images.sh: resolve the Ubuntu release per image via ubuntu_version_for, so both the build arg and the version-specific tags reflect the release each image is actually built from.

golang, java, node, and desktop need no file changes; they inherit from base/minimal and roll forward automatically.

Validation

Verified upstream availability of the required resolute bases:

Dependency	resolute available?
ubuntu:resolute / ubuntu:26.04	✅
download.docker.com/linux/ubuntu resolute stable	✅
mcr.microsoft.com/devcontainers/universal:resolute	❌ (latest codename tag is noble)

Verified per-image tag resolution:

base       -> ubuntu-resolute
minimal    -> ubuntu-resolute
golang     -> ubuntu-resolute
java       -> ubuntu-resolute
node       -> ubuntu-resolute
desktop    -> ubuntu-resolute
universal  -> ubuntu-noble

Note

The universal image is built from mcr.microsoft.com/devcontainers/universal, which does not yet publish a resolute tag. It's pinned to noble via UBUNTU_VERSION_OVERRIDES, which also ensures it is published as ubuntu-noble (not mislabeled as ubuntu-resolute). Tracked in #335 to re-couple once upstream publishes a resolute tag.

Caution

Not built locally. CI / a Depot build is the validation gate before merge.

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻

[johnstcn]

This change is worth calling out, as users of the rolling tag will need to be aware of the change. How do we plan to communicate this?

[matifali]

This change is worth calling out, as users of the rolling tag will need to be aware of the change. How do we plan to communicate this?

Good call @johnstcn. I will hold this change until release 2.36, and we will announce it on Coder.com/chnagelog along with that release. Any customers using this should not be using the latest tag in production, but just in case it's worth calling out.

[johnstcn]

Approving to unblock. As per Atif's comment above, do not merge until release.

[linear-code]

DEVEX-653