[Kevin Cho (chokevin)]

Azure Container Linux host-image resolution started failing before VM provisioning because Azure CLI's az sig image-version show-shared selected unsupported Microsoft.Compute API version 2026-03-03 for locations/sharedGalleries in westus2. The harness now resolves latest through the same ARM resource with az rest pinned to supported API version 2024-03-03, while preserving the existing optional ACL_IMAGE_SUBSCRIPTION forwarding.

This is a compatibility workaround for deterministic Azure CLI drift tracked in Azure/azure-cli#34229; upstream is reverting the regression in Azure/azure-cli#34232.

• Uses az account show to resolve the effective subscription, then URL-encodes each shared-gallery path component and requests the exact Microsoft.Compute/locations/sharedGalleries/.../versions/latest?api-version=2024-03-03 resource.
• Keeps both Azure commands behind the existing acl_az builder, so ACL_IMAGE_SUBSCRIPTION is forwarded consistently.
• Removes the failing show-shared lookup only from Azure Container Linux gallery-version resolution.
• Adds focused assertions for the account lookup, exact REST URL/API version, subscription forwarding, and absence of show-shared.

Evidence

• Main run 38856809524 failed with the same shared-gallery API-version error, showing the failure is not caused by fix(agent): use CDI runtime on Azure Linux GPUs #935.
• #935 reproduced the failure in agent e2e (host acl, nspawn azlinux3) before provisioning.
• #933 run 38860909243 passed the Azure Container Linux E2E on the same runner image with this workaround present among unrelated changes. This PR isolates only the two-file CI fix.

Verification

• Passed: cd hack/agent/e2e-kind && python3 -m unittest -v test_host_image.py (43 tests)
• Passed: COPYFILE_DISABLE=1 TMPDIR="$PWD/tmp/python-tests" python3 -m unittest discover -s hack/agent/e2e-kind -p 'test_*.py' (111 tests)
• Passed: python3 -m py_compile hack/agent/e2e-kind/e2e.py hack/agent/e2e-kind/test_host_image.py
• Passed: git diff --check

Risk

The change is limited to CI host-image discovery. The primary risk is future ARM API retirement or a shared-gallery resource-shape change; the focused command/URL tests detect accidental drift, and reverting this commit restores the Azure CLI command once the upstream fix is available.

Non-goals

• No product or runtime code changes.
• No changes to fix(agent): use CDI runtime on Azure Linux GPUs #935 or its NVIDIA device/runtime behavior.
• No changes to gallery export, provisioning, Machines, nodes, releases, or deployments.

AI assistance: Used GitHub Copilot to help implement the isolated workaround, run validation, and draft this description; the author verified the diff, commands, links, and final text.

[Kevin Cho (chokevin)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved the conflicts and merged main in commit f19b5ff. The host-image tests pass.