test(cli): integration harness for the real-I/O seams (kind e2e)

[LukasWodka]

Summary

Adds the missing safety net under the CLI's real-I/O code — the seams the mock-based unit suite can't reach, where every live bug actually lived (SPDYExecutor.Exec is 0% in unit coverage). Independent of the modality stack; branches off develop.

What it adds

• test/integration/ (//go:build integration):
  • Connectivity — cluster.Load + NewClientset against a live API server.
  • StageAndVerify — creates a throwaway namespace + PVC + stage pod, streams a dataset via the real SPDYExecutor tar-over-exec, then exec's back into the pod to confirm the files landed. Covers SPDYExecutor.Exec, StreamLayout, CreateStagePod, WaitForStagePodReady.
• make test-integration — runs against your ambient kubeconfig (kind, k3d, any dev cluster).
• .github/workflows/e2e.yml — boots kind + runs the suite, gated to nightly / manual / e2e-labeled PRs (kind boot is too heavy per-PR).

Validation

Ran locally against a live k3d cluster — both tests pass; the stream lands files on the PVC and the exec-back confirms content (filename,label / 001.jpg). Build-tag-gated, so go test ./... and the CI test job are unaffected.

⚠️ The kind CI job itself gets its first real run on the nightly schedule, manual dispatch, or an e2e-labeled PR (can't exercise GH Actions from a local run). Add the e2e label to this PR to smoke it.

Why this matters

This harness covers the exact code path behind the staging↔DEST collision, the validator drift, and the schema skew — all of which were only caught by manual live runs this cycle. Follow-ups (in the harness README): a PortForward fixture and a full dataset push through a real jobs-manager + ingestor to catch cross-component schema skew end-to-end.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 21 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• cli#16 — test(cli): coverage wins (preflight/progress/errors) + smoke-test hardening · author: @LukasWodka · no reviewer assigned
• client#171 — Installer: verify readiness & credentials before reporting success; RHEL-family support · author: @LukasWodka · no reviewer assigned
• client-runtime#45 — Staging: Enhance jobs-manager with HTTP proxy, ingestion endpoint, and fixes · author: @saadqbal · no reviewer assigned
• client-runtime#61 — docs: record MySQL credential threat-model decision · author: @saadqbal · no reviewer assigned
• data-ingestors#132 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• data-ingestors#133 — docs: fix declarative-ingest path/column drift (issue #131 A-series) · author: @divyasinghds · no reviewer assigned
• data-ingestors#138 — test(e2e): end-to-end ingestion equivalence suite (all modalities, real MySQL) · author: @LukasWodka · no reviewer assigned
• data-ingestors#139 — fix(ingest): MLM tokenizer + relax PascalVOC difficult + reserved-id guard (#137, #135) · author: @LukasWodka · no reviewer assigned
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[aptracebloc]

Rebased onto develop — schema-drift green. Labeled e2e to actually run the harness: Integration (kind) PASSES, so the SPDYExecutor + StreamLayout tar-over-exec seam compiles and works end-to-end on a real kind cluster — the coverage gap I flagged is now closed. All other checks green. LGTM.