fix: Bugbot findings from promotion PR #383 (probe timeout + kubectl version + Windows leftover-data guard)

[shujaatTracebloc]

Resolves three Cursor Bugbot findings on the client promotion PR (#383, develop → main).

Fixes:

• Probe hangs on wedged Docker (High) — _probe_runtime_usable (scripts/lib/probe.sh) ran a bare docker info with no timeout, and run_host_probes calls it on every install, so a wedged Docker daemon hung a headless SSH install indefinitely. Now bounded with timeout/gtimeout (a 5s cap, TB_PROBE_TIMEOUT-overridable) when either is present, falling back to the bare call otherwise. Read-only and never fatal — a timeout just reads as "not usable". (Release develop → main #383 (comment))
• Retry notices corrupt kubectl version (High) — install_kubectl (scripts/lib/setup-linux.sh) captured retry's stdout notices into KUBE_VER, polluting the version and breaking the download URL. Isolated the value the same way the Helm resolver does: tail -1 + tr -d '[:space:]' + a version-tag regex that fails closed on an unresolvable value. (Release develop → main #383 (comment))
• Windows missing leftover-data guard (Medium) — New-K3dCluster (scripts/install-k8s.ps1) never checked for leftover data, so Windows reinstalls silently adopted prior MySQL/dataset data (bash has guard_leftover_data; the README documents the guarantee). Ported the guard to PowerShell: detects leftover data (flat + per-release layouts), and on a fresh cluster prompts reuse / wipe / different-dir, honoring $env:TB_LEFTOVER_ACTION (reuse|wipe), $env:HOST_DATA_DIR (different dir), and $env:TRACEBLOC_SKIP_LEFTOVER_GUARD, with a non-interactive fail-safe abort — matching the bash contract and the README. Windows is hostpath-only (New-K3dCluster always bind-mounts HOST_DATA_DIR), so it's scoped to hostpath; node-local (RFC-0003 Option C) is a Linux/k3s prototype with no Windows path. Refactored the HOST_DATA_DIR validation out of Confirm-Config into a shared Confirm-DataDir rather than duplicating it. (Release develop → main #383 (comment))

Coverage: bats tests for the bounded docker probe (timeout applied / fallback / non-zero → not usable) and the kubectl version isolation (clean capture / fails closed on a notice-only result); Pester tests for Get-LeftoverDataDirs detection and Invoke-LeftoverDataGuard (skip / reuse / wipe / non-interactive abort / interactive w / default abort). scripts/manifest.sha256 refreshed for the probe.sh + setup-linux.sh + install-k8s.ps1 changes. No golden impact (probe/kubectl/leftover paths aren't captured in the copy-catalog goldens).

Lands on develop; the promotion PR head picks these up on the next develop sync and Bugbot re-reviews.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes affect every install’s runtime probe and fresh Windows cluster creation (data wipe paths); mistakes could hang installs, fetch wrong kubectl, or mishandle user data—mitigated by fail-closed behavior and extensive tests.

Overview
Addresses three Bugbot findings from promotion PR #383: installer reliability on wedged Docker, corrupted kubectl version strings, and missing Windows parity for leftover-data protection.

Linux (probe.sh, setup-linux.sh) — _probe_runtime_usable now caps docker info with timeout/gtimeout (default 5s, TB_PROBE_TIMEOUT) so every install’s host probe cannot hang on a wedged daemon; failures stay non-fatal (“not usable”). install_kubectl isolates the version from dl.k8s.io/release/stable.txt with tail -1, whitespace strip, and a tag regex so retry stdout notices no longer pollute KUBE_VER and break the download URL.

Windows (install-k8s.ps1) — Ports bash guard_leftover_data before new k3d cluster creation: detects real MySQL/dataset data (flat and per-release layouts), prompts reuse / wipe / new dir / abort, honors TB_LEFTOVER_ACTION, HOST_DATA_DIR, and TRACEBLOC_SKIP_LEFTOVER_GUARD, and fails closed when non-interactive with no choice. Shared Confirm-DataDir replaces duplicated HOST_DATA_DIR validation; wipe uses Remove-TreeNoFollow so nested junctions are unlinked without deleting targets outside the tree. Help documents reinstall behavior.

Docs & supply chain — .cursor/BUGBOT.md updates reviewer guidance (curl_secure(), ingestor prodDigest in chart defaults). scripts/manifest.sha256 refreshed for touched bootstrap scripts.

Tests — New/extended bats (probe.bats, setup-linux.bats) and Pester coverage for detection, guard actions, and junction-safe wipe.

^{Reviewed by Cursor Bugbot for commit 83dc2f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c282d7. Configure here.}