Add a deterministic multi-resource diagnostic analyzer layer

[hellices]

Goal

Add a deterministic multi-resource diagnostic layer that produces structured,
testable findings before an LLM explains or investigates them.

Current gap

korvid has strong pod-state projection through diagnose_pod, pod trouble
hints, and an agent evaluation pack. Diagnosis remains disproportionately
pod-centric. Common incidents require reasoning across resources:

• a Deployment whose rollout stalls behind unavailable replicas;
• a Service whose selector has no ready endpoints;
• a PVC that cannot bind;
• a PDB that blocks maintenance;
• node pressure and scheduling constraints;
• a workload that references a missing ConfigMap or Secret.

Today the agent can discover these through generic reads, but the result depends
more heavily on model planning and interpretation than necessary.

Design

Introduce a pure, deterministic analyzer boundary that returns structured
findings such as:

• stable rule id and analyzer version;
• severity and confidence category based on explicit rule semantics;
• primary and related resource identities;
• exact evidence fields/events used;
• concise explanation and next read-only checks;
• optional remediation guidance, never executable action.

Initial analyzers:

1. Deployment/StatefulSet/DaemonSet rollout health and ownership chain.
2. Service selector to EndpointSlice readiness.
3. PVC binding and StorageClass/provisioning evidence.
4. PDB disruption allowance and blocked-drain evidence.
5. Node pressure, taints, pod scheduling conditions, and quota evidence.
6. Missing referenced ConfigMaps and Secrets without exposing Secret values.

Expose findings through a read-only agent/MCP tool and a human-readable TUI
surface. The LLM may summarize or investigate further, but it must not be the
source of the finding.

Acceptance criteria

• Analyzer inputs and outputs are framework-independent typed data.
• Every rule has positive, negative, ambiguous, RBAC-denied, and stale-data
  tests with fixture evidence.
• Findings cite exact resource fields/events and never invent evidence text.
• Duplicate symptoms across related resources are grouped without hiding the
  underlying rule results.
• Partial RBAC produces an explicit evidence gap rather than a healthy result.
• Secret existence may be checked, but Secret values never enter findings.
• The agent and MCP receive identical structured findings from the same
  registry-derived read tool.
• TUI rendering works without an LLM or [agent] extra.
• The initial rules are versioned so changed semantics can be identified in
  reports and eval results.

Related work

• Local/on-prem agent quality: conversational AKS exploration eval, model scoreboard, prompt/tool tuning, and AKS matrix #176 remains the canonical model-quality and scoreboard tracker. Analyzer
  changes should be evaluated there, not by creating a second model benchmark.

Out of scope

• Autonomous remediation.
• A general policy engine or replacement for admission policy.
• Attempting to cover every Kubernetes resource in the first release.

[hellices]

Phase 1 merged in #213 (988e337): deterministic Service → EndpointSlice diagnosis is now shared by the embedded agent and MCP via diagnose_service.

Delivered:

• versioned rule/output contract with structured findings, evidence, and explicit gaps;
• healthy / no slices / no ready endpoints / ExternalName / RBAC-unavailable / stale Service-owner handling;
• native TypeMeta-less EndpointSlice projection using authoritative API-group metadata;
• custom-controller-owned slices remain valid because stale checks consider only core/v1 Service owner references;
• one Service GET + one EndpointSlice LIST, bounded parseable YAML, and Service follow navigation;
• full CI and CodeQL green, with 4,113 local tests passing before PR review.

#191 remains open for the remaining analyzer families: rollout generalization, PVC/StorageClass, PDB, node/scheduling/quota, and missing ConfigMap/Secret references, plus broader TUI finding surfaces.