[chen21019]

Ubuntu 26.04 consumers still ship packages for which upstream has accepted security fixes, even when the Ubuntu archive has no compatible binary update. Add five original-Ubuntu source backport builders and a separate, versioned build-only OCI input for qualified packages; consumers install only packages already present in their final runtime stage.

The static Go installer preserves package sets, dependencies, ABI, configuration and the existing GNU/uutils provider. Package bytes, native CI identity, source locks, licensing and regression evidence are bound before publication. Real GNU and uutils consumer installation fixtures must pass before any OCI push. Native Trivy OpenVEX remains the findings interpreter; the shared read-only guard checks exact consumer SBOM/package/provenance closure and never filters findings.

Validation already completed:

• glibc: 7,127 PASS, 19 XFAIL, 174 UNSUPPORTED, 14 XPASS; no FAIL/ERROR/UNRESOLVED; all three new fopen controls PASS.
• Rust coreutils: 5,438 PASS, 84 original upstream ignored, 17 original Ubuntu exclusions; 19 id cases and 15 packaged distinct-GID results PASS. Separate exact-source review confirms the original 18 upstream fixes without relying on version ordering.
• jq: all nine owning suites and packaged ABI/CLI controls PASS.
• p11-kit: original full-suite summary 1,081 PASS / 1,079 unique cases / zero skips, plus RPC/ABI/package controls PASS; the new 32-bit-only advisory is not claimed exploitable on amd64.
• libXrender: patched/original-negative/packaged Xvfb reply-boundary cases and ABI checks PASS. Its upstream make-check defines zero cases, not additional functional coverage.
• Static installer unit tests/build and focused qualifier/metadata-boundary tests PASS. Required CodeQL and the real prepublication consumer fixtures must complete on the reviewed source.

Tar backports were rejected after the original cyclic-rename regression lost three restored files. The failing evidence is retained; no skip, expected-output change, incompatible package or runtime patch is offered. Ruby/Onigmo host coverage remains a separate tracked scope.

This PR publishes no product runtime and does not change deployed services. Individual consumer image releases, exact final-rootfs SBOM/raw scans, scoped VEX and affected-function acceptance remain required before product CVEs can close. No production site, firewall, HAProxy or production database changes are included.