feat: Expand deterministic incident diagnostics (explain.rs) to PVCs, Services, and Nodes

[ByteEngr]

Problem / Motivation

sofka's X incident view (explain.rs) is one of its most powerful features, providing deterministic, evidence-based root cause analysis for unhealthy workloads and pods without external AI dependencies.

Currently, explain.rs has dedicated diagnosis logic (explain_workload and explain_pod) for Deployments, StatefulSets, DaemonSets, ReplicaSets, and Pods. For other resource types (e.g. PersistentVolumeClaims, Services, Nodes), it falls back to generic event listing (explain_generic).

Expanding explain.rs with dedicated diagnostic evaluation for PVCs, Services, and Nodes will make X significantly more useful across common Kubernetes failure modes.

Proposed Scope

We propose adding dedicated diagnostic functions in src/explain.rs:

1. PersistentVolumeClaims (explain_pvc):

   • Detect Pending PVCs and surface root causes (e.g., non-existent StorageClass, waiting for first consumer in WaitForFirstConsumer binding mode, storage quota exceeded, or volume provisioning failure events).

2. Services (explain_service):

   • Detect Services with selector defined but 0 active endpoints or pods matching the label selector.
   • Highlight missing target ports or missing endpoints.

3. Nodes (explain_node):

   • Evaluate NodeCondition array (MemoryPressure, DiskPressure, PIDPressure, NetworkUnavailable, Ready=False/Unknown).
   • Extract and rank node condition message evidence.

Technical Design

• Pure Architecture: All changes remain pure in src/explain.rs. explain(&Evidence) will dispatch to explain_pvc, explain_service, and explain_node based on ev.plural.
• Unit Testing: Every new diagnostic rule will have pure unit tests added directly to src/explain.rs using mock DynamicObject fixtures without requiring a cluster.

Question for Maintainers

Does this scope align with sofka's design goals for the incident view? Once agreed, we can open a focused PR with the implementation and tests.