chore(installer): honest step labels + per-tool progress in the Windows installer (#422)

[shujaatTracebloc]

What & why

Step 1/5 "Checking system requirements" in the PowerShell installer actually installed ~700 MB of tooling (Docker Desktop, kubectl, k3d, helm) — nearly all console-silent (the download progress overlay is off for speed since #471, and the winget / Add-AppxPackage / installer invocations print nothing). Users read the dead air as a hang. The k3d cluster start re-run path also streamed raw INFO[0000] … lines past the style system.

Changes (scripts/install-k8s.ps1)

• Honest step split: Step 1 "Checking system requirements" (preflight / GPU / virtualisation) and a dedicated Step 2 "Installing system tools"; renumbered to /6.
• Invoke-WithHeartbeat: runs a blocking op in a background job with a live spinner (built on the existing Wait-JobWithProgress), so nothing in Steps 1–2 sits silent >10s. Wired into every tool download (kubectl / k3d / helm / winget / Docker Desktop), the winget installs, Add-AppxPackage, and the Docker Desktop installer.
• Get-ToolSummaryLine: one honest line per tool as it becomes ready — name, version, size, elapsed (e.g. kubectl v1.31.0 (~60 MB, 12s)).
• k3d start output: routed through Invoke-WithHeartbeat — captured to the log with a styled heartbeat instead of raw INFO[…], and now fails loudly if start fails (was always reporting "started").

Acceptance (from #422)

• Split Step 1 into check vs install
• Per-tool line: name, version, size, elapsed
• Spinner + label during each winget invocation
• Route k3d start/create output through the tone engine
• No console-silent window >10s in Steps 1–2

Copy catalog

The copy catalog is bash-driven (reads step_header from install-k8s.sh), and the bash installer already splits check (a) from install (b) with real progress (spin_cmd / download_with_progress). This change is PowerShell-only, so the catalog golden is unaffected — copy-catalog.bats stays green.

Tests

• Pester: Get-ToolSummaryLine (formatting), Invoke-WithHeartbeat (returns output / throws on failure / passes ArgumentList), and source guards for the 6-step split + no-raw-k3d-output.

Local verification

Pester 241/0/8 · bats 559 ok (only the 3 known macOS-local flakes) · copy-catalog green · check-style pass · drift clean · manifest regenerated · PS parse OK.

Closes #422

---

Note

Low Risk
Installer UX and progress/error-handling only on Windows PowerShell; no auth, cluster logic, or bash installer changes beyond the manifest hash.

Overview
The Windows install-k8s.ps1 flow is renumbered to six steps: preflight/GPU/virtualization stay in step 1, and ~700 MB of tooling (winget, Docker Desktop, kubectl, k3d, helm) moves to a dedicated “Installing system tools” step so labels match what actually runs.

Invoke-WithHeartbeat wraps long silent work (HTTPS downloads, Add-AppxPackage) with the existing spinner via background jobs; Get-ToolSummaryLine prints one green line per tool (version, size, elapsed) after Assert-ToolRuns. Job init now re-applies TLS 1.2 in job runspaces so corporate proxies don’t break in-job downloads.

winget, the Docker Desktop installer, and k3d cluster start use Start-Process + Wait-ProcessWithDeadline (kill on timeout) instead of jobs that could orphan children. Docker install adds winget→direct-download fallback and explicit failure if the exe never appears. Pester covers the new helpers and source guards; manifest.sha256 is updated for install-k8s.ps1.

^{Reviewed by Cursor Bugbot for commit ef4b7c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 34 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc  #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI) #221) · author: @divyasinghds · no reviewer assigned
• averaging-service#232 — Merge Staging to Main · author: @saqlainsyed007 · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1326 — release-train: staging -> master · author: @LukasWodka · reviewer: @saadqbal
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e6be743. Configure here.}