test(cli): cover runClusterInfo/runClusterDoctor post-discovery

[LukasWodka]

Summary

Routes the last two commands that reached a cluster directly — runClusterInfo (cluster info) and runClusterDoctor (doctor) — through the existing loadClusterFn/newClientsetFn seams, and adds a doctorRunFn seam over doctor.Run. This makes their post-discovery logic testable without a real kubeconfig or apiserver.

Pure seam routing — the package vars default to the real functions, so there is no production behavior change (5 direct calls → seam vars). This closes structural root-cause #1 from the coverage audit (runClusterInfo/runClusterDoctor bypassing the seam that resolveClusterTarget and the data commands already use; realProbeEnv was routed in an earlier PR).

Coverage

cli package own-coverage 77% → 79.3%; the two functions:

func	before	after
runClusterInfo	exit-3 branch only	95.6%
runClusterDoctor	auth half + kubeconfig-error only	100%

runClusterInfo — exit-4 no-client, exit-5 release-found-but-no-token (proving the install-print block renders before token minting), all three arms of the token-expiry switch (server ExpiresAt / requested-only / static-secret "never"), and the image-digest configured/not-configured branches. Pins the security contract: the raw token is never printed, only sha256(token)[:8].

runClusterDoctor — the clientset-build error arm, the render loop (all three status arms + remedy hints), and the overall-verdict switch (Fail→exit 2 silent / Warn→exit 0 / OK→exit 0), with the auth half stubbed healthy so the verdict reflects the cluster checks.

Test plan

• make ci green (build, vet, gofmt -s, go test -race -cover, errcheck/ineffassign/misspell, schema-check).
• New tests use the established withClusterSeams + fake.NewSimpleClientset + TokenRequest PrependReactor (mirrors internal/cluster/token_test.go) and the existing stubBackend seam for doctor's auth half — no real cluster required.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only seams and new unit tests; production call sites still invoke the same underlying cluster helpers via package-level defaults.

Overview
cluster info and doctor now load kubeconfig through the same loadClusterFn / newClientsetFn hooks that data commands already use, replacing direct cluster.Load / cluster.NewClientset calls. Production still defaults those vars to the real implementations, so runtime behavior is unchanged.

doctor adds a doctorRunFn seam over internal/doctor.Run so tests can drive the Checks render loop and overall verdict without a live cluster.

New tests exercise runClusterInfo post-discovery: exit codes 4/5, install block before token mint, all three token-expiry display arms, static-secret fallback, digest configured vs placeholder, and the rule that only sha256(token)[:8] is printed. runClusterDoctor tests cover OK/Warn/Fail rendering, remedy hints, exit 2 vs 0 verdicts, and clientset-build failures (exit 3).

^{Reviewed by Cursor Bugbot for commit b76dbd7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1329867. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b76dbd7. Configure here.}

[saadqbal]

LGTM 👍 Production side is just the behavior-preserving seam routing (loadClusterFn/newClientsetFn/doctorRunFn, all defaulting to the real fns), and the tests finally reach the post-discovery paths that only a live cluster could hit before — nice to see the token-expiry switch arms and the sha256[:8] never-print-the-raw-token contract pinned. Same stacked-rebase note as the sibling seam PRs.