Enable CONFIG_FS_ENCRYPTION (fscrypt) in 3.0 kernels

[dethoma]

Merge Checklist

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted
• LICENSE-MAP files are up-to-date
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Enables the Linux filesystem-level encryption feature (fscrypt) across the Azure Linux 3.0 kernel flavors. fscrypt provides native per-directory encryption (used by tools like fscryptctl/fscrypt and the FS_IOC_SET_ENCRYPTION_POLICY ioctl) for ext4, f2fs, and other supporting filesystems. Previously all 3.0 kernels shipped with # CONFIG_FS_ENCRYPTION is not set.

This change sets CONFIG_FS_ENCRYPTION=y and CONFIG_FS_ENCRYPTION_ALGS=y in every self-compiling 3.0 kernel flavor. The required crypto select-closure symbols (AES/CBC/CTS/ECB/XTS/HMAC/SHA256/SHA512/SKCIPHER/LIB_SHA256/KEYS) were already =y, so there is no olddefconfig drift.

Change Log

• fscrypt enabled (config + config_aarch64 where applicable): kernel, kernel-hwe, kernel-mshv, and kernel-64k (aarch64-only).
• kernel-uki inherits fscrypt automatically — it reuses the prebuilt kernel vmlinuz (no own kernel config), so no config change was required there.
• Updated the corresponding config/config_aarch64 SHA-256 hashes in kernel.signatures.json, kernel-hwe.signatures.json, kernel-mshv.signatures.json, and kernel-64k.signatures.json.
• Bumped Release (1 → 2) with changelog entries on the affected kernel specs, and cascaded matching Release bumps to all entangled sibling specs to satisfy the Version-Release lockstep check (kernel-signed, kernel-64k-signed, kernel-uki, kernel-uki-signed, kernel-64k, kernel-headers, kernel-hwe-signed, kernel-hwe-headers, kernel-mshv-signed).
• Updated the toolchain/worker package manifests (toolchain_x86_64.txt, toolchain_aarch64.txt, pkggen_core_x86_64.txt, pkggen_core_aarch64.txt) to reflect the new kernel-headers/kernel-cross-headers -2 release, since kernel-headers is a toolchain package.

Affected packages: kernel, kernel-hwe, kernel-mshv, kernel-64k, kernel-uki, kernel-headers, kernel-cross-headers, and their -signed/-headers variants.

Does this affect the toolchain?

YES — kernel-headers is a toolchain package; its Release bump required updating the toolchain and pkggen_core manifests. The toolchain was rebuilt successfully in the pipeline.

Associated issues

• N/A

Test Methodology

• Full Azure Linux pipeline build (Toolchain + RPMs + Sodiff) succeeded on both AMD64 and ARM64.
• Pipeline build id: 1155026