y-cluster: initial Go binary and serve feature

[solsson]

What this is

Bootstraps y-cluster as a single Go binary (CLI + library + container
image), with the first end-user feature y-cluster serve ready for a
v0.2.0 pre-release.

Scope

y-cluster binary

• Single static Go binary, distributed as:
  • tagged release assets (y-cluster_vX.Y.Z_{linux,darwin}_{amd64,arm64})
  • ghcr.io/yolean/y-cluster:<sha> / :<vX.Y.Z> multi-arch distroless
    image (linux/amd64 + linux/arm64, each with the native binary)
• Refuses to run as UID 0; aligns with the distroless :nonroot base
• Can be symlinked as kubectl-yconverge for kubectl plugin use

Subcommands

• y-cluster yconverge -k <base> — idempotent Kubernetes convergence
  with CUE-declared dependency ordering and post-apply checks. Replaces
  the y-cluster-converge-ystack and kubectl-yconverge bash scripts
  in ystack. Dependencies are declared as CUE imports between
  convergeable bases; checks are aggregated across the kustomize tree
  so overlays inherit the checks of their bases.

• y-cluster provision / teardown / export / import — QEMU-based
  local cluster lifecycle, with a VMDK appliance round-trip so a senior
  developer can hand a prepared cluster to a new teammate without
  re-running provision.

• y-cluster serve -c <dir> [-c <dir> ...] — new, first-release
  feature. HTTP server for config assets. One port per config, no
  name-based vhosting. Default background daemon with per-user state
  dir, pidfile, single-instance rule; --foreground opts out.
  Graceful SIGTERM/SIGINT shutdown, drain in-flight, remove pidfile,
  exit zero. serve ensure is idempotent and blocks on per-port
  /health before returning.

  Initial backend is y-kustomize-local, which reads
  y-kustomize-bases/{group}/{name}/{file} trees and serves them at
  /v1/{group}/{name}/{file}, emulating the in-cluster y-kustomize
  service for local development. Multi-source merge; duplicate routes
  across sources are a startup error. Responses force revalidation
  via weak ETag + Cache-Control: no-cache, must-revalidate.
  Kustomization files using secretGenerator / configMapGenerator
  rename syntax (key=path) are rejected at startup because they
  would cause the local route to silently diverge from the in-cluster
  route.

Packages (importable as a library)

pkg/
  yconverge/             CUE dependency resolution, check runner, apply
  kustomize/traverse/    local-dir kustomize tree walker
  provision/qemu/        VM lifecycle via QEMU + cloud-init + SSH
  kubeconfig/            cross-provisioner kubeconfig helpers
  serve/                 HTTP server, config schema, state dir,
                         pidfile, multi-port, y-kustomize-local backend

All packages have sibling test files; unit coverage is > 90 % for the
serve package and the kustomize-traverse package. End-to-end tests
live under e2e/ behind the e2e build tag (kwok cluster + real
binary).

Testing

• go test ./... — unit tests for every package plus the CLI layer
• go test -tags e2e ./e2e/ — spins up kwok, drives convergence and
  check orchestration; also builds the y-cluster binary and runs
  scripts/e2e-serve-against-binary.sh against it
• scripts/e2e-serve-against-binary.sh — standalone bash e2e that
  exercises serve ensure → GET → stop against any y-cluster binary
• .github/workflows/e2e-release.yaml — fires on release: published,
  downloads the published binary on ubuntu-latest and macos-latest,
  verifies the sha256 from checksums.txt, and runs the same bash
  e2e against the shipped bytes

Release pipeline

One workflow (.github/workflows/ci.yaml) is the single source of
truth for build, test, image, and release:

• build matrix produces every arch binary once per run; downstream
  jobs consume via artifacts so the image and the release archive
  ship the exact same bytes that CI tested
• image uses solsson/setup-contain@v1 to install contain v0.9.0,
  then contain build --push with per-arch pathPerPlatform so every
  variant of the multi-arch image carries the right native binary
• release-assets (tag pushes only) publishes raw uncompressed
  binaries using goreleaser naming
  (y-cluster_vX.Y.Z_<os>_<arch>) alongside a checksums.txt
• image and release-assets jobs are guarded on
  github.repository_owner == 'Yolean' so they stay a no-op outside
  the public repo; the human owner mirrors from the internal
  automation repo when ready

Known gaps / follow-ups (post-merge)

• type: static backend for serve is schema-declared but returns
  "not implemented" at runtime (deferred to a later release)
• y-kustomize-in-cluster backend (Kubernetes informer against Secret
  objects) not yet implemented
• A couple of observability regressions from the bash implementation
  are accepted here and scheduled for follow-up rather than blocking
  this PR: kubectl output is currently swallowed by the check runner,
  and yconverge.Run silently ignores traverse errors
• CUE import parsing still hardcodes the yolean.se/ystack/ module
  prefix; the cleanup to read the module name from cue.mod/module.cue
  is small but not in scope for this PR

[solsson]

Squashed into a single commit f7fa70b