Bump docker/setup-qemu-action from 4.3.0 to 4.4.0

[dependabot]

Bumps docker/setup-qemu-action from 4.3.0 to 4.4.0.

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 targeted tools absent from 23-tool catalog	BLOCKED	⚠️
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes	not attempted — gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A/C reads all succeeded (issues, PRs, README.md, commits via MCP and CLI proxy).
• Part B: none of add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request appear in the exposed 23-tool GitHub MCP catalog (all read-only tools: list/get/search). Absence proves backend GITHUB_READ_ONLY=1 config per gh-aw's tools.github: wrapper, not independently the gateway's own DIFC/guard layer — recorded INCONCLUSIVE per methodology, not PASS.
• Part D/E: gh auth status reported not logged in (401-equivalent, exit 1) in this environment, so no REST/GraphQL write attempts could be made to validate the token-scope boundary. No writes attempted, nothing leaked.
• No write succeeded on any surface in this run.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned (list_issues, list_pull_requests, get_file_contents, list_commits)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 targets absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	reads	data returned via github CLI proxy	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

(⚠️ Part B: add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request are all absent from the github CLI proxy's 23-tool catalog — this reflects gh-aw's backend GITHUB_READ_ONLY=1 config, not mcpg's own gateway-level DIFC enforcement, so this run cannot independently confirm the gateway's write-blocking layer. ⚠️ Parts D/E: gh auth status reported no authenticated host, so REST/GraphQL write attempts could not be made in this environment.)

No write leaked in any part of this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime