fix(cli): delete guard fails fast on 426; keep-data save failure marks offboard degraded

[saadqbal]

Resolves the two new Cursor Bugbot findings on #164 (same never-lie / fail-fast class as the prior rounds).

High — keep-data save failure left a stale on-disk pointer + clean closing

Under --keep-data, the active-client fields are cleared in memory, but if cfg.Save() failed the on-disk config still named the revoked client and the closing line could still read as a clean offboard. Now that Save failure marks the offboard degraded (honest closing) and the warning points the user at tracebloc logout / manual removal.

Medium — online guard softened HTTP 426

The pre-offboard online check treated anylookupClientStatus error — including *api.UpgradeRequiredError (426, CLI too old) — as warn-and-continue. A 426 won't recover by proceeding (the whole offboard hits the same backend), so it now fails fast with the upgrade message, matching runClientStatus. Transient errors (5xx/429/network) still warn and continue, since the teardown is the real gate.

Note on scope of degraded

degraded intentionally tracks tracebloc-side / enrollment state left behind (release, cluster, on-host data, the active-client pointer). Image reclaim and CLI self-removal are local-disk niceties with their own actionable hints and are excluded — the machine is genuinely offboarded from tracebloc's side once the credential is revoked, so those don't flip the closing to a warning.

Tests

Added: a 426 during the guard fails fast with the upgrade message and runs neither revoke nor any teardown. go build/vet/test ./... green (11 pkgs).

Rolls up under §7.10 offboarding (Bugbot follow-up — no separate ticket).

🤖 Generated with Claude Code

---

Note

Low Risk
Targeted offboarding UX and error-handling fixes in the CLI delete path; no auth or API contract changes beyond aborting delete earlier on 426.

Overview
Pre-offboard online guard now treats HTTP 426 (*api.UpgradeRequiredError) as fail-fast with the standard upgrade message instead of warn-and-continue. Transient lookup errors (5xx, 429, network) still warn and skip the guard, since teardown is the real safety gate.

Under --keep-data, if clearing the active-client pointer in memory succeeds but cfg.Save() fails, offboard is marked degraded so the closing line does not read as a full success, and the warning directs users to tracebloc logout or manual config cleanup.

Adds TestDelete_Guard426_FailsFast to assert no revoke or teardown runs after a 426 on the status lookup.

^{Reviewed by Cursor Bugbot for commit 3708e15. Bugbot is set up for automated code reviews on this repo. Configure here.}