fix: harden d601 k3s guards

scripts/src/dev-env.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import { runCommand } from "./command";
 import { repoRoot, rootPath } from "./config";
+import { d601K3sGuardShellLines, d601NativeKubeconfig } from "./d601-k3s-guard";
 import { startJob } from "./jobs";
 
 const defaultManifest = "src/components/microservices/k3sctl-adapter/k3s/dev/unidesk-dev-foundation.k8s.yaml";
@@ -216,7 +217,26 @@ function validateDatabaseUrl(url: string): { ok: boolean; url: string; reason: s
 }
 
 function kubectlDryRun(manifestPath: string): unknown {
-  const kubeconfig = "/etc/rancher/k3s/k3s.yaml";
+  const kubeconfig = d601NativeKubeconfig;
+  const guardScript = d601K3sGuardShellLines(kubeconfig).join("\n");
+  const guard = runCommand(["sh", "-lc", guardScript], repoRoot, {
+    timeoutMs: 60_000,
+    env: { ...process.env, KUBECONFIG: kubeconfig },
+  });
+  const guarded = guard.exitCode === 0;
+  if (!guarded) {
+    return {
+      command: ["sh", "-lc", "d601 native k3s guard"],
+      kubeconfig,
+      exitCode: guard.exitCode,
+      signal: guard.signal,
+      timedOut: guard.timedOut,
+      ok: false,
+      guard: "d601-native-k3s",
+      stdoutTail: guard.stdout.slice(-4000),
+      stderrTail: guard.stderr.slice(-4000),
+    };
+  }
   const result = runCommand(["kubectl", "apply", "--dry-run=client", "--validate=false", "-f", manifestPath], repoRoot, {
     timeoutMs: 60_000,
     env: { ...process.env, KUBECONFIG: kubeconfig },
@@ -262,15 +282,13 @@ function prewarmImagesScript(options: PrewarmImagesOptions): string {
     `proxy_url=${shellQuote(options.proxyUrl)}`,
     `pull_missing=${options.pullMissing ? "1" : "0"}`,
     `pull_timeout_seconds=${pullTimeoutSeconds}`,
-    "kubeconfig=/etc/rancher/k3s/k3s.yaml",
     "ctr_address=/run/k3s/containerd/containerd.sock",
+    ...d601K3sGuardShellLines(),
     "export DOCKER_CONFIG=/tmp/unidesk-dev-env-docker-config",
     "mkdir -p \"$DOCKER_CONFIG\"",
     "printf '{}\\n' > \"$DOCKER_CONFIG/config.json\"",
-    "printf 'dev_env_k3s_context='",
-    "KUBECONFIG=\"$kubeconfig\" kubectl config current-context",
     "printf 'dev_env_k3s_nodes='",
-    "KUBECONFIG=\"$kubeconfig\" kubectl get nodes -o name | tr '\\n' ' '",
+    "kubectl get nodes -o name | tr '\\n' ' '",
     "printf '\\n'",
     "for image in \"${images[@]}\"; do",
     "  if docker image inspect \"$image\" >/dev/null 2>&1; then",