deps: bump cilium/cilium to v1.19.5 and cilium/ebpf to v0.22.0

[Quang Nguyen (nddq)]

Description

Bumps the cilium dependency constellation, anchored on cilium/cilium and letting its requirements dictate the coupled satellites:

Module	From	To
github.com/cilium/cilium	v1.19.3	v1.19.5
github.com/cilium/ebpf	v0.21.0	v0.22.0
github.com/cilium/statedb	v0.5.6	v0.5.8 (cilium's requirement)
github.com/cilium/hive	pseudo (2026-01-08)	unchanged (cilium's pin)
k8s.io/*	v0.35.3/.4	v0.35.6 (patch lockstep ride-along)

The satellites deliberately do not go to their newest tags: cilium/cilium v1.19.5's own pkg/hive fails to compile against hive v1.0.4 / statedb v0.8.x:

cilium@v1.19.5/pkg/hive/reconciler_metrics.go:96:9: *reconcilerMetricsImpl does not implement reconciler.Metrics (wrong type for method PruneDuration)
	have PruneDuration(cell.FullModuleID, "time".Duration)
	want PruneDuration(cell.FullModuleID, string, "time".Duration)

Supersedes #2493 (same ebpf bump, here as part of the coherent set). #2490 (hive → v1.0.4-rc1) and #2454 (statedb → 0.8.2) should be closed as incompatible with cilium v1.19.x per the error above — those modules can only move when cilium/cilium itself does.

Related Issue

N/A.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...).
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable. (N/A — dependency bump.)

Screenshots (if applicable) or Testing Completed

go build ./... clean; go test ./pkg/... -count=1: 41 packages pass, no new failures relative to main (the two locally-failing packages — pkg/controllers/daemon/retinaendpoint needing envtest assets and pkg/loader needing bpftool — fail identically on an untouched main checkout).

Additional Notes

• The hack/tools and /site modules have no cilium dependencies; only the root go.mod/go.sum change.
• Not worth extending the cilium dependabot group to minors (as deps: group k8s.io minor updates in dependabot config #2512 does for k8s): the satellites' latest tags are incompatible with pinned cilium/cilium by design, so grouped minor PRs would still be unbuildable — this constellation needs anchored manual bumps.
• Follow-up: the HUBBLE_VERSION CLI pin in the agent image (v1.19.3 in the Makefile/Dockerfile) can be aligned to v1.19.5 separately, per the precedent of deps: bump hubble CLI to v1.19.3 #2310.

[github-actions]

Retina Code Coverage Report

Total coverage no change

Increased diff

Impacted Files	Coverage
pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go	82.25% ... 83.28% (1.03%)	⬆️