feat(#435): single-source cross-OS installer facts + CI parity gate (RFC D3/D4)

[shujaatTracebloc]

#435 — single-source cross-OS installer facts + CI parity gate (RFC-CLIENT-0003 D3/D4)

The costliest drift class of the 2026-07 installer sweep was facts diverging between the three OS implementations — most painfully the #410 incident: the k3d/helm pins were bumped in bash (#382) but not PowerShell (#410), which failed a real customer install. Copy already solved its half with the byte-exact catalog; behavior facts get the same treatment here.

What this adds

scripts/spec/facts.env — the single source of truth
Tool version pins (K3D_VERSION / HELM_VERSION / K8S_VERSION) + the READY_TIMEOUT budget. One place to change a cross-OS fact.

scripts/check-facts.sh — generate + gate (mirrors gen-manifest.sh)

• --write stamps the spec into every consumer: bash common.sh + summary.sh, PowerShell install-k8s.ps1.
• --check is the CI gate — non-zero if any consumer drifted from the spec.

Nothing is sourced at runtime — consumers carry literal values, so the single-file verified bootstrap (R8) is untouched.

CI wiring — installer-tests.yaml runs check-facts.sh --check, failing the PR if a fact was changed in one OS path but not the others. install-k8s.ps1's "keep in lockstep" comment now points at the enforced spec.

Acceptance criteria

• ✅ Changing a pinned version/timeout in one place (facts.env) updates every OS path (--write) or fails CI (--check).
• ✅ The fix(installer): pin k3d + helm versions in install-k8s.ps1 — drop api.github.com latest lookups #410-class incident (pin in bash, absent/stale in ps1) is reproducible as a red CI check — check-facts.bats reproduces it in both directions.

(Hosts are already single-sourced + drift-checked by check-drift.sh Checks 1 & 5.)

Tests / gates

• scripts/tests/check-facts.bats (9): fix(installer): pin k3d + helm versions in install-k8s.ps1 — drop api.github.com latest lookups #410 reproduced red (both directions), --write round-trips for versions and the timeout, fail-closed on a moved pattern, bad-mode rejection.
• shellcheck --severity=error, check-style, check-drift clean; check-facts.sh --check green; manifest.sha256 regenerated (R8). bash-3.2-safe.

Follow-ups (same mechanism — a new fact is one row in facts.env + check-facts.sh)

• Memory floors (PF_MIN_*) — bash-only today; add once PowerShell gains matching gates.
• The behavior-parity matrix (feature × OS with waivers) — a distinct deliverable best in its own PR.

Closes#435

---

Note

Low Risk
Installer tooling and CI guards only; pinned defaults are unchanged and values are not sourced at runtime.

Overview
Introduces scripts/spec/facts.env as the authoritative list of cross-OS installer facts (k3d/helm/k8s version pins and READY_TIMEOUT), replacing hand-kept parity between bash and PowerShell.

Adds scripts/check-facts.sh (--write / --check, same pattern as gen-manifest.sh) to stamp those values into common.sh, summary.sh, and install-k8s.ps1 without sourcing the spec at runtime (R8 bootstrap unchanged). Installer static CI now runs check-facts.sh --check and includes the script in shellcheck, so a #410-style bump in one OS path fails the PR. check-facts.bats covers drift in both directions, --write round-trips, and fail-closed behavior when stamped patterns move. manifest.sha256 is refreshed for the touched PowerShell installer; comments in install-k8s.ps1 document the enforced spec.

^{Reviewed by Cursor Bugbot for commit 05055b6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c374d1d. Configure here.}

[LukasWodka]

/fr-pass