[1.2] Release 1.2.9

[lifubang]

[1.2.9] - 2025-11-27

Stars hide your fires, let me rest tonight.

Fixed

• libct: fix mips compilation. (Fails to build on mips64le #4962, [1.2] libct: fix mips compilation #4965)
• When configuring a tmpfs mount, only set the mode= argument if the
  target path already existed. This fixes a regression introduced in our
  CVE-2025-52881 mitigation patches. (Recent security update changed default permissions of tmpfs #4971, [1.2] rootfs: only set mode= for tmpfs mount if target already existed #4974)
• Fix various file descriptor leaks and add additional tests to detect them as
  comprehensively as possible. ([v1.3.3] Error response from daemon: failed to create task for container #5007, [1.2.8] runc appears to apply rlimits to itself prior to validating device nodes #5021, [1.2] fix fd leaks and detect them as comprehensively as possible #5027)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2,
  which should make it easier for some downstreams to import runc without
  pulling in too many extra packages. ([1.2] fix fd leaks and detect them as comprehensively as possible #5027)

[rata]

c&p mistake, but important. I might not be responsive tomorrow, but feel free to take this as a LGTM once that is fixed :)