chore(cli): kubeconfig-flag helper + pinned lint/deadcode gate + dead-export cleanup (#127)

[LukasWodka]

What

The remaining tech-debt items of cli#127. (The resolveClusterTarget helper and the dataset→data rename sweep already shipped; this covers the rest.) Refs #127 rather than Closes — the issue's optional "CLI-layer tests for the destructive data delete path" box stays open.

ITEM 1 — shared addKubeconfigFlags helper. New internal/cli/flags.go centralizes the --kubeconfig/--context registration (plus a separate addNamespaceFlag for -n, kept separate so client create doesn't gain a spurious -n) that was duplicated inline across 7 command files (client, cluster, data, data_delete, data_list, delete, doctor). Pure refactor — flag names/shorthands/defaults/usage byte-identical, proven by diffing --help output for all 7 commands built from both branches (identical).

ITEM 2 — pinned lint + deadcode gate. errcheck/ineffassign/misspell pinned (were @latest) in both the Makefile and build.yml; the stale "Tool versions are unpinned" comment removed; added a deadcode gate (golang.org/x/tools/cmd/deadcode@v0.48.0) as a make deadcode target + CI step. The gate is advisory (non-blocking) for now: deadcode flags 7 funcs, but 4 are out-of-scope/unsafe to remove — di#349 CSV/ingestor parity harnesses used only by tests (ReadLabelValues, inferColumnType), and two String() Stringer methods reached via fmt reflection that static analysis can't see (Status.String, JobOutcome.String) — and the other 3 are the ITEM-3 test-only symbols below. A code comment documents how to flip it blocking once that backlog is cleared.

ITEM 3 — dead test-only exports unexported. config.Clear→clearAll (clear is a Go builtin), push.AllCategoryIDs→allCategoryIDs, submit.IsSubmitError→isSubmitError — all had zero production callers (referenced only by same-package tests), so unexported (not deleted) with test call-sites updated.

Tests / gates

go build/vet OK; gofmt -l clean; go test ./... green; coverage-floor.sh (cli 73.9% ≥ 68%, submit 76.1% ≥ 72%); the pinned linters run clean; deadcode advisory (7 findings, documented).

Merge-conflict note

ITEM-1 touches the flag-registration block in data.go/data_delete.go/doctor.go/delete.go, which several in-flight PRs (#229/#230/#231 + the delete branches) also touch — but the diff is limited to the Flags() lines and those PRs mostly edit RunE/logic, so the risk is low-moderate and mechanical to resolve.

Refs #127.

🤖 Generated with Claude Code

---

Note

Low Risk
Mostly refactor and tooling; CLI flag behavior is intended to be byte-identical, and unexported symbols had no production callers.

Overview
#127 tech debt: centralizes duplicated --kubeconfig / --context (and optional -n/--namespace) registration in new internal/cli/flags.go, wired from seven commands with the same defaults and help text as before.

CI/Makefile: pins errcheck, ineffassign, and misspell (replacing @latest) with version vars kept in sync between the Makefile and build.yml; adds an advisory deadcode scan from ./cmd/tracebloc (continue-on-error in CI, || true in make deadcode) and includes it in make ci.

Dead exports: unexports test-only symbols—config.Clear → clearAll, push.AllCategoryIDs → allCategoryIDs, submit.IsSubmitError → isSubmitError—with same-package tests updated; no production behavior change.

^{Reviewed by Cursor Bugbot for commit ad80846. Bugbot is set up for automated code reviews on this repo. Configure here.}