fix(installer): Windows fresh install never added the tracebloc Helm repo (#385)

[LukasWodka]

Fixes#385.

Root cause

Install-Client's repo presence guard string-matched the stderr-merged, stringified output of helm repo list:

$repoList= (helm repo list 2>&1) |Out-Stringif ($repoList-notmatch [regex]::Escape($TRACEBLOC_HELM_REPO_NAME)) { … add … }

On a fresh machine helm repo list exits 1 writing to stderr, and Windows PowerShell 5.1 renders that ErrorRecord with the position decoration — which embeds this script's own temp path (…\Temp\tracebloc-installer-<n>\install-k8s.ps1). That path contains the literal tracebloc, so the guard concluded the repo was already registered and skipped helm repo add on every fresh Windows install. The unchecked helm repo update then failed silently, and Step 4 died at helm upgrade --install with the cryptic Error: repo tracebloc not found (field-hit 2026-07-24; the decoration is visible in the captured failure output). The bash installer is immune (anchored grep over stdout only). CI missed it because Pester mocks helm as a function (no NativeCommandError rendering) and e2e is Ubuntu-only.

Fix

1. install-k8s.ps1 — delete the guard; always helm repo add --force-update (idempotent, heals a stale/wrong URL, re-fetches the index — so the separate unchecked helm repo update is dropped too). Failure now aborts with helm's actual output instead of a bare "Failed to connect to tracebloc." The failure class is unreproducible by construction — there is no output-matching left.
2. Preflight now probes the chart repo's index.yaml, strictly (both twins): the old probe hit https://tracebloc.github.io/ which 404s by design yet counted as "reachable" (any-HTTP-response semantics — deliberate for registry endpoints that answer 401, so the default semantics are unchanged). New per-target strict mode:
   • Test-PfUrl -RequireSuccess (ps1) → "http <code>" on non-2xx/3xx;
   • _pf_probe_url <url> strict (bash) — criticals entries gain an optional |strict field.
3. scripts/manifest.sha256 regenerated (R8).

Tests

• Pester: repo add invoked with --force-update + canonical URL before upgrade; add-failure aborts with helm's output and never reaches upgrade; Test-PfUrl -RequireSuccess 404→http 404, 200→ok, connection-failure classification unchanged.
• bats: _pf_probe_url strict mapping (404→http 404, 200/301→ok, default mode still 404→ok, curl exit codes unchanged); _pf_connectivity hard-fails when the chart index 404s under strict.
• Local: bash -n ✔, check-style.sh ✔, bats preflight.bats 52/52 ✔, shellcheck --severity=error (CI mode) ✔, gen-manifest.sh ✔. (Pester runs in CI — no pwsh on this machine.)

Notes for review

• --force-update intentionally rewrites an existing tracebloc repo entry to the canonical URL — that's the healing behavior we want (e.g. a stray manually-added root-URL entry).
• Windows connect-flow modernization (login + client create, replacing the manual Client-ID prompts entirely) is tracked separately in Installer (Windows): still the legacy manual Client-ID/password connect — port RFC-0001 provisioning (login + client create) from the bash installer #388 — this PR keeps the current flow but makes its Helm step correct and loud.

🤖 Generated with Claude Code

---

Note

Low Risk
Installer and preflight-only changes with regression tests; no runtime client or auth logic touched.

Overview
Fixes #385: fresh Windows installs could skip helm repo add and later fail with repo tracebloc not found.

Windows (install-k8s.ps1) drops the helm repo list string guard (PowerShell 5.1 stderr can embed a temp path containing tracebloc, so the add was skipped). Every run now runs helm repo add … --force-update (no separate repo update), and a failed add aborts with Helm’s output instead of a generic message.

Preflight (PowerShell + bash) adds strict URL checks: by default any HTTP response still counts as reachable (registries that return 401). For the chart repo, probes move to …/client/index.yaml with strict mode so a 404 on the site root no longer looks healthy when the index is missing.

Tests cover repo registration, add failure handling, and strict probing; manifest.sha256 is updated.

^{Reviewed by Cursor Bugbot for commit a603c48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a603c48. Configure here.}

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- on multiple Ubuntu releases + \u2014 a real install exercised end-to-end on real distros, behind a TLS-inspecting proxy\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.