systemd: fix pcrlock failure on Hyper-V VMs with vTPM

[liulanze]

Merge Checklist

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Backport upstream systemd fix for systemd-pcrlock failures on Hyper-V/Azure VMs with vTPM.

On Hyper-V, the vTPM event log lists hash algorithms in a different order in the records than declared in the header. systemd v255 uses strict positional index matching which fails with "Hash algorithms in event log record don't match log", causing systemd-pcrlock-firmware-code, systemd-pcrlock-firmware-config, systemd-pcrlock-make-policy, and systemd-pcrlock-secureboot-authority services to fail on boot.

The upstream fix (commit e90a255 from systemd v256, PR systemd/systemd#31429) replaces the positional index lookup with a search loop so the algorithm is matched by ID regardless of ordering.

Change Log

• Add fix-pcrlock-hyperv-hash-algorithm-ordering.patch backported from upstream systemd v256 (commit e90a255)
• Bump Release from 26 to 27

Does this affect the toolchain?

NO

Associated issues

• upstream fix: pcrlock: handle cases where order of hash algs in firmware binary logs differs in header and records systemd/systemd#31429

Links to CVEs

N/A

Test Methodology

• Built custom systemd RPM (255-27) with the patch using Azure Linux toolkit
• Deployed to Azure Trusted Launch VM with Secure Boot and vTPM enabled
• Verified systemd health check passes with 0 failed units and system state running
• All pcrlock services complete successfully without any bypass workaround
• Pipeline build for verifications listed above