[202412] Remove GCU skip-sort bypass and backport patch sorter crash fix (#4668)

[rimunagala]

Why I did it

The skip_sort_tables bypass was added to 202412 in March/April 2026 (#293, #300, #305) as an
interim mitigation, at a time when GCU apply-patch was too slow for the Fairwater DACL scenario
and was tripping Hw-proxy inband / NDM WCF timeouts.

That mitigation has since been overtaken by the actual performance work, which is now on this
branch:

Change	Landed on 202412 via
sonic-net/sonic-utilities#3831 — GCU performance enhancements	#254
sonic-net/sonic-utilities#4310 — GCU wheel	#352
sonic-net/sonic-utilities#4476 — cache loadData() calls	#352
sonic-net/sonic-utilities#4478 — batch leaf-list changes into a single REPLACE move	#352
sonic-net/sonic-utilities#4554 — init SonicDBConfig for multi-ASIC	#352

Beyond being redundant, the bypass actively suppresses the signal we need. While it is in place,
any patch whose operations all match /ACL_TABLE/FAIRWATER_DACL_MITIGATION*/ports never
reaches the sorter at all — so a healthy apply time on those patches cannot be used as evidence
that sorting performance is fixed. Removing it is a prerequisite for producing that evidence.

How I did it

Commit 1 — remove the skip-sort bypass

• drop the skip-sort block and import fnmatch from generic_updater.py
• delete generic_config_updater/skip_sort_tables.txt
• drop the corresponding setup.py package_data entry
• remove the three unit tests covering the bypass, and their helper

import jsonpatch and JsonChange are deliberately kept, even though #293 added them
alongside the bypass. They are not part of it: the else: branch of if sort: already referenced
both symbols without importing them, so the sort=False path carried a latent NameError that
#293 incidentally fixed. Removing them would reintroduce that bug.

Commit 2 — backport sonic-net/sonic-utilities#4668

The patch sorter aborted with an unhandled ValueError ("'<x>' is not in list") when a patch
changed a create-only PORT field (e.g. lanes during a breakout) while that port was a member of
a multi-member leaf-list such as ACL_TABLE.ports. The exception escaped
RemoveCreateOnlyDependencyMoveValidator._validate_member and aborted the whole sort, failing the
apply and triggering auto-rollback. The fix treats an unresolvable reference in a simulated
intermediate config as an invalid move, so the DFS backtracks instead of aborting.

This is required here rather than optional: commit 1 routes ACL_TABLE.ports patches into the
sorter, and ACL_TABLE.ports is the exact leaf-list named in the upstream report. Without it, the
newly-enabled code path carries a known crash.

Cherry-picked cleanly from upstream 0552d0d24f67b287d74ef82ef7922f389f715c5f with no conflicts.
Re-authored to match the backport convention used by #352; original author credited via
Co-authored-by.

How to verify it

pytest tests/generic_config_updater/generic_updater_test.py
pytest tests/generic_config_updater/patch_sorter_test.py \
  -k test_validate__unresolvable_ref_in_simulated_config__move_rejected

Checks already performed locally:

• no residual skip_sort / skip-sort reference anywhere in the tree
• generic_updater.py now differs from its pre-[generic_config_updater]: Skip patch sorting for ACL_TABLE/DENY_NEW_INGRESS_TABLE #293 state by exactly the two intentionally
  retained imports and nothing else
• the test-file change was produced by reverse-applying [generic_config_updater]: Skip patch sorting for ACL_TABLE/DENY_NEW_INGRESS_TABLE #293's own diff — 108 deletions,
  0 insertions
• py_compile clean; flake8 code profile unchanged from the 202412 baseline
  (generic_updater.py 16/16, generic_updater_test.py 30/30, patch_sorter.py 72/72)

Rollout note

Merging this removes the mitigation from every subsequent 202412 image build, not just from
piloted devices. The intent is to build a GCU addon container from this branch and pilot it on a
small number of 20241212.61 devices with the MRC isolation scenario owners before it reaches
wider fleet use.

Not included

• sonic-net/sonic-utilities#4335 (suboptimal plan for CreateOnly paths) — deliberately deferred.
  It is +74/-40 in patch_sorter.py and rewrites ~135 lines of expected-plan test fixtures, i.e.
  it intentionally changes generated plans. That deserves its own validation cycle rather than
  riding along here. Cherry-pick conflicts are small (3 hunks / 29 lines) if we decide to take it.
• sonic-net/sonic-utilities#4118 (remove direct libyang dependency) — dependency refactor,
  unrelated to this change.

Which release branch to port

• 202412

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[rimunagala]

Superseded by #437.

Same three-commit change, but opened from a fork so the branch can actually be updated during
review. Branch protection on this repo requires the license/cla status check, which cannot
report until after a push has landed - so a branch here can be created but never updated, which
made it impossible to push review fixes onto this PR's head branch.

#437 carries an additional commit adapting #4668's regression tests to the 202412
JsonMoveGroup / validate() signatures, plus the full before/after unit-test results.

Closing this one to avoid duplication. No review had started here.