Automator: update envoy@ in istio/proxy@master

Author: istio-testing

WORKSPACE

@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-11-06
-ENVOY_SHA = "78cff0755120fdf87b5e06eb3cf7d283866a6d9b"
+# Commit date: 2025-11-09
+ENVOY_SHA = "4ec8ebcab6d431f4f9f6f293b43d4cec07a3f034"
 
-ENVOY_SHA256 = "80d7204651620631af127a02102e2f3263d47d435ef9a4b503ba37191adf2c5b"
+ENVOY_SHA256 = "05dfcd102fa674d808ebe0d2fa696efda1629a5074edf7fb9d8badf25ea1fd99"
 
 ENVOY_ORG = "envoyproxy"
 

envoy.bazelrc

@@ -90,6 +90,7 @@ build --@com_googlesource_googleurl//build_config:system_icu=0
 # Common flags for sanitizers
 build:sanitizer --define tcmalloc=disabled
 build:sanitizer --linkopt -ldl
+test:sanitizer --build_tests_only
 
 # Common flags for Clang (shared between all clang variants)
 build:clang-common --action_env=BAZEL_COMPILER=clang