fix(doctor): stop the cluster-down cascade of misleading remedies

[LukasWodka]

Fixes #350 · epic backend#1142 (Theme A).

Problem

When the cluster API is unreachable (Docker/k3d stopped — the reported prod case), tb doctor ran all 8 downstream checks anyway; each invented a domain-specific cause with the wrong fix (storage / chart-reinstall / RBAC), burying the one true cause under ~6 false ✖/⚠.

Fix

• New StatusUnknown (Worst() ignores it → verdict/exit code unchanged).
• isUnreachable(err) distinguishes a transport error from ErrNoParentRelease/RBAC/NotFound (API answered).
• Run() short-circuits on an unreachable API: one honest Cluster reachable ✖ + 7 StatusUnknown ("couldn't check"). checkBackendEgress still runs (probes from this machine). When the API IS reachable, every check behaves exactly as before — isolated-failure messaging preserved.
• checkReachable names the endpoint and, for a loopback server, gives the local-cluster remedy ("start Docker Desktop, then k3d cluster start").
• StatusUnknown renders as a neutral · line (no remedy).

Before → after (cluster down)

Before: 9 lines, ~6 wrong remedies (RBAC / StorageClass / "reinstall the chart").
After: Cluster reachable ✖ "the cluster API server at https://127.0.0.1:6550 isn't answering — is the cluster running?" → start Docker Desktop, then k3d cluster start; the rest render · <check> — could not check — cluster API unreachable.

Verification

TestRun_UnreachableCascade (fake clientset + connection-refused reactor) asserts the one ✖ names the endpoint + start remedy, the 7 cluster checks are StatusUnknown with no remedy, backend egress still ok, and Worst()=Fail (exit code preserved). gofmt/vet clean; doctor + cli packages green.

---

Note

Low Risk
Read-only diagnostic UX and verdict logic only; reachable clusters keep the previous per-check behavior, covered by new tests.

Overview
When the Kubernetes API cannot be reached (e.g. local cluster stopped), tracebloc doctor no longer runs every downstream check and surfaces bogus fixes (PVC, chart reinstall, proxy). It now treats transport failures as a single root cause and keeps the rest honest.

doctor package: Adds StatusUnknown (ignored by Worst() so exit codes stay driven by real ✖/⚠). isUnreachable() separates dial/timeout/DNS errors from cases where the API answered (missing chart, RBAC). Run() short-circuits on unreachable APIs: one Cluster reachable failure, cluster-dependent checks as neutral “couldn’t check”, while Backend egress still runs from the CLI machine. checkReachable uses ServerURL to name the endpoint and suggests starting Docker/k3d for loopback servers.

CLI: Passes ServerURL into doctor options and prints StatusUnknown as a neutral info line (no remedy).

Tests cover the unreachable cascade and loopback transport messaging.

^{Reviewed by Cursor Bugbot for commit e5c9047. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e5c9047. Configure here.}

[LukasWodka]

Superseded and already shipped. #356 was stacked on this branch, so its merge to develop carried this reachability gate in full (StatusUnknown / checkReachable / isUnreachable / isLoopback / the unreachable short-circuit). The doctor redesign (#365) has been rebased onto that develop and no longer cherry-picks this branch. Closing as superseded — no code lost. (Branch left intact.)