fix(installer): pre-create per-release hostPath dirs on Windows (#653)

[LukasWodka]

Closes#653 (backlog cleanup epic backend#1588).

Bug

bash `_ensure_release_dirs` (scripts/lib/cluster.sh) pre-creates `<HOST_DATA_DIR>//{logs,mysql}` + the `data` dir before install; `install-k8s.ps1` had no equivalent. On Windows the mount target then does not exist when the client first ingests, and the write fails with Permission denied.

Fix

Adds `Ensure-ReleaseDirs` (mirrors the bash: logs/mysql under HOST_DATA_DIR, data under HOST_DATASET_DIR when set else HOST_DATA_DIR; idempotent via `New-Item -Force`) and calls it before both helm paths (fresh install `$TB_NAMESPACE` and adopted-reuse `$existingName`).

Verified: PowerShell AST parses clean (pwsh 7.5.2). Functional validation is the Windows e2e journey (no local Windows).

---

Note

Low Risk
Installer-only change that creates local directories before Helm; no cluster auth or runtime logic changes, with fail-fast behavior on create errors.

Overview
Fixes Windows dataset ingest failing with "Permission denied" (#653) by bringing the PowerShell installer in line with bash _ensure_release_dirs.

Adds Ensure-ReleaseDirs, which idempotently creates <HOST_DATA_DIR>/<release>/logs, mysql, and data (with data under HOST_DATASET_DIR when set, per backend#743). Directory creation uses New-Item -Force with -ErrorAction Stop so real failures (ACL, AV locks) are not swallowed and later show up as permission errors after a successful-looking install.

The helper runs immediately before both Helm paths: fresh helm upgrade --install for $TB_NAMESPACE and adopted-release reconcile for $existingName. scripts/manifest.sha256 is updated for install-k8s.ps1.

^{Reviewed by Cursor Bugbot for commit c868eb9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e984d4b. Configure here.}

[LukasWodka]

Fixed — Ensure-ReleaseDirs now uses -ErrorAction Stop, so a failed create aborts the install (fail closed, matching bash mkdir -p under set -e) instead of printing connected and deferring the error to first ingest. -Force keeps it idempotent. Manifest regenerated.

[aptracebloc]

@LukasWodka — Recommend closing this in favor of #654 (cc @shujaatTracebloc). The R8 manifest here verifies clean (shasum -c → all 18 OK) and the PowerShell is well-written, but two things:

1. It likely doesn't fix #653. This pre-creates the dirs on the Windows host via New-Item, but the failure is a permissions one: kubelet's DirectoryOrCreate creates the in-node mount path root:root 0755 and ignores fsGroup on hostPath (kubernetes#138411), so host-side existence alone doesn't make uid 1000 able to write — and New-Item can't set uid 1000 / mode 3777. Also, when HOST_DATASET_DIR is set the data binds at a different path, which this doesn't cover.
2. It conflicts with #654. Both edit scripts/install-k8s.ps1 + regenerate scripts/manifest.sha256 with mutually-exclusive hashes, so they can't both merge — whichever lands second fails the manifest check.

#654 (already code-owner-approved, with Pester + hostpath-prep.bats coverage) does the in-node chown 1000:1000 + chmod 3777 that mirrors the chart's init-writable-data container and handles the dataset-mount path split — it's the correct/complete fix. Suggest closing #659 unless there's a Windows case #654 misses (if so, let's reconcile with @saadqbal since they collide on the manifest).

🤖 Generated with Claude Code

[divyasinghds]

Approving — PowerShell Ensure-ReleaseDirs faithfully mirrors bash _ensure_release_dirs (logs/mysql under HOST_DATA_DIR, data under HOST_DATASET_DIR when set) and runs before both helm paths. Verified: manifest.sha256 matches the modified install-k8s.ps1 exactly; the node-local guard is correctly omitted (no Windows path, install-k8s.ps1:2718); chmod 777 correctly not mirrored (Docker Desktop handles Windows mount ownership). CI green incl. Pester (windows-latest). ✅