chore(deps): update helm release cilium to v1.19.4

[renovate]

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	1.19.3 → 1.19.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.19.4

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Caution

🩺 Integration diagnosis — mode: upgrade, phase: upgrade

Commit: 7ce76ac · Run: #26251247548

Likely cause: kube-prometheus-stack v85.1.3 bundles prometheus-node-exporter chart v4.55.0, which appends a -distroless variant suffix to image tags; since the HelmRelease sets tag: v1.11.1@sha256:{hex} (digest embedded in the tag field), the chart produces the unparseable reference quay.io/prometheus/node-exporter:v1.11.1@sha256:{hex}-distroless, permanently blocking the DaemonSet pod and causing Windsor Up to time out in the upgrade phase.

Evidence: Pod kube-prometheus-stack-prometheus-node-exporter-pgzfr in system-telemetry is stuck in InvalidImageName / Pending state for the full cluster lifetime. The kubelet reports: couldn't parse image name "quay.io/prometheus/node-exporter:v1.11.1@sha256:0f422f62c15f154af8d8572b23d623aebfb10cec73a5c654d18f911f3f9df241-distroless": invalid reference format. The deployed DaemonSet spec confirms this corrupted reference, while the HelmRelease values correctly store only tag: v1.11.1@sha256:0f422f62c15f154af8d8572b23d623aebfb10cec73a5c654d18f911f3f9df241 — the -distroless suffix is appended by the chart itself. All kustomizations and HelmReleases reconciled successfully, confirming the blockage is exclusively at the pod layer. The system-cni/cni kustomization is still pinned to main@sha1:69e36b05 (cilium v1.19.3), meaning Windsor Up timed out before the cilium v1.19.4 upgrade from this PR could even reconcile.

Suggested next step: Add prometheus-node-exporter.image.suffix: "" under the prometheus-node-exporter block in kustomize/telemetry/base/prometheus/helm-release.yaml to suppress the chart's automatic -distroless suffix; this same fix is needed on origin/main where kube-prometheus-stack v85.1.3 (PR #1806) introduced the regression — the upgrade path cannot converge until the baseline is also fixed.

Live read-only inspection by Claude. Support bundle attached to the run artifacts.