test(e2e): real release discovery + TokenRequest minting on kind

[LukasWodka]

Summary

The final item from the "what else on testing" plan: expand the thin e2e scenario set. The kind harness already exists (.github/workflows/e2e.yml + test/integration/ + make test-integration) — this adds discovery_e2e_test.go, covering the real-apiserver seams the unit suite can only fake:

• TestIntegration_DiscoverReleaseAndMintToken — cluster.DiscoverParentRelease finds a chart-labeled jobs-manager Deployment (release name, chart version, INGESTOR_IMAGE_DIGEST) via a live label-selector List, then cluster.MintIngestorToken mints through the real TokenRequest subresource. Unit tests stub TokenRequest with a PrependReactor, so the modern path's server-stamped ExpiresAt + TokenRequest source are only ever truly verified against a real apiserver (kind is cluster-admin, so create serviceaccounts/token is permitted).
• TestIntegration_FindClientNamespaces — the §7.3 cluster-wide fallback scan finds a client in each of two throwaway namespaces via a NamespaceAll List.

Fixtures are label-only (replicas: 0) so nothing schedules or pulls an image; each test uses throwaway namespaces and cleans up.

Test plan

• Compiles + vets under -tags integration (go vet -tags integration ./test/integration/); excluded from make ci by the build tag, so the normal build is unaffected.
• This PR carries the e2e label so e2e.yml runs the kind job on it (the actual run authority — these can't run without a live cluster).

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only changes behind the integration build tag; no production CLI or cluster logic is modified.

Overview
Adds discovery_e2e_test.go under the integration build tag, extending the kind harness with scenarios that hit the live Kubernetes API where unit tests only use fakes.

TestIntegration_DiscoverReleaseAndMintToken seeds a throwaway namespace with a chart-labeled, zero-replica jobs-manager Deployment and an ingestor ServiceAccount, then asserts cluster.DiscoverParentRelease returns release name, chart version, and INGESTOR_IMAGE_DIGEST, and cluster.MintIngestorToken succeeds via the real TokenRequest subresource (non-empty token, TokenSourceTokenRequest, server ExpiresAt).

TestIntegration_FindClientNamespaces places the same fixture in two namespaces and checks the §7.3 NamespaceAll scan returns both. Helpers newThrowawayNS and jobsManagerDeployment keep fixtures label/env-only so nothing schedules or pulls images.

test/integration/README.md documents the new coverage alongside existing integration tests.

^{Reviewed by Cursor Bugbot for commit e82c823. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e82c823. Configure here.}

[saadqbal]

LGTM 👍 Good to finally exercise the real TokenRequest subresource + label-selector discovery against a live apiserver — the paths unit tests can only PrependReactor-stub. Verified the fixture labels map correctly (client-1.6.0→ChartVersion 1.6.0, instance→ReleaseName, env→digest) and the signatures line up. Label-only replicas-0 fixtures + throwaway namespaces with cleanup is the right touch. Note it's //go:build integration, so it's outside the develop unit-CI checks — runs in the kind job only, matching the existing suite.