fix(device-plugin): run the OpenHands rebuild of generic-device-plugin

[aivong-openhands]

Why

The device-plugin subchart runs ghcr.io/squat/generic-device-plugin:2cc50b0, upstream's latest image (2026-05-15). Trivy reports 25 high findings on it with fixes available, in Go 1.26.2, grpc, golang.org/x/net and golang.org/x/text; four are real exposures (an HTTP/2 denial of service on the plugin's :8080 health/metrics port, reachable from other pods, and three gRPC denial-of-service bugs on the kubelet socket), and the plugin runs privileged on sandbox nodes. Upstream has had no commits or image releases in five months (last commit and image 2026-05-15), and its open dependency PRs, including the grpc and x/net bumps, have sat unmerged since July, so waiting for an upstream image is not an option.

This points the subchart at ghcr.io/openhands/generic-device-plugin:5cb2f8c, built from the OpenHands fork (OpenHands/generic-device-plugin#1): upstream 2cc50b0 with Go 1.26.9, grpc 1.83.2, x/net 0.60.0 and x/text 0.42.0, same binary path and entrypoint, plus LICENSE and dependency NOTICE files. The Replicated values override only the image repository, so they move to the fork through the same proxy prefix as the other ghcr.io/openhands images; leaving them on squat's repository would have requested a tag that does not exist there. The plugin stays enabled: false by default.

Validation

• Trivy — ghcr.io/squat/generic-device-plugin:2cc50b0 reports 0 critical / 25 high (all fixable); the published ghcr.io/openhands/generic-device-plugin:5cb2f8c reports 0 / 0 for both linux/amd64 and linux/arm64, and pulls anonymously.
• Cluster run — the image from the fork branch, installed with this subchart in a kind cluster, registered with kubelet, the node advertised squat.ai/fuse: 256, and a non-root pod with all capabilities dropped requested squat.ai/fuse: 1, received /dev/fuse and opened it read-write; /health returned 200 and /metrics reported go_info{version="go1.26.9"}. The fork's CI also runs upstream's Go suite, including its kind-based end-to-end test, on the bumped dependencies.
• Chart tests — helm unittest for the subchart (7 tests), helm lint with device-plugin.enabled=true, and the Replicated template tests (scripts/test_replicated_*.py, scripts/test_*template*.py, 142 tests) pass.

Helm Chart Checklist

• I have tested the chart upgrade path from the previous version — the DaemonSet only changes image; the resource names (squat.ai/*, and smarter-devices/kvm in Replicated) and args are unchanged.
• I have verified backwards compatibility with existing values.yaml configurations — a user-set device-plugin.image still wins.
• I have updated the chart's README.md if there are any breaking changes or new required values — no new required values.

This PR was drafted by an AI agent on behalf of the user.