chore: sync with upstream FairwindsOps/nova

[mayankpande88]

Description

Merge FairwindsOps/nova upstream master (HEAD 0803b08, 2026-04-27) into our main. We were 118 commits ahead and 42 commits behind upstream. This catches us up.

Single merge commit. Conflicts resolved as documented below.

What's new from upstream (net diff: 10 files, +114/-56)

• cmd/root.go, pkg/containers/images.go, pkg/helm/cluster.go, pkg/kube/kube.go — --kubeconfig flag (upstream #329) threaded through handleHelm / handleContainers / handleHelmAndContainers / containers.NewClient / nova_helm.NewHelm.
• pkg/helm/findscore.go (+74 lines) — ArtifactHub stars field and scoring tweak (upstream #355).
• pkg/helm/artifacthub.go, pkg/helm/artifacthub_cached.go, pkg/helm/findscore_test.go — small follow-ons.
• .gitignore — one extra ignore entry.

Conflict resolution (kept ours / stayed deleted)

Path	Reason
.circleci/config.yml	Re-deleted. We use GitHub Actions.
.goreleaser.yml	Re-deleted. We build via Dockerfile + GH Actions.
docs/.vuepress/public/scripts/marketing.js	Re-deleted. Fairwinds analytics.
docs/package-lock.json	Re-deleted. VuePress docs site removed in open-source cleanup.
CODEOWNERS	Kept ours (@mayankpande88). Upstream's is Terraform-managed for Fairwinds engineers.
Dockerfile	Kept ours (multi-stage build from source). Upstream expects a pre-built binary from CircleCI/goreleaser.
README.md	Kept ours (Nudgebee-fork README with upstream attribution).
go.mod / go.sum	Kept ours. We are ahead of upstream on every overlapping dependency (k8s 0.36.0 vs 0.33.x, helm 3.20.2 vs 3.18.x, controller-runtime 0.24.0 vs 0.21.0, etc.).

Trivial whitespace conflict in cmd/root.go:52 (blank line inside init()) resolved manually.

Review Notes — Risks & Counterarguments

• Upstream's CVE/vuln-fix commits are no-ops for us: all expressed as go.mod version bumps to versions we exceeded via our own dependabot. Resolving go.mod/go.sum as "keep ours" is correct, not a downgrade.
• Public function signatures changed: containers.NewClient, nova_helm.NewHelm, and the three handle* helpers now take an extra kubeConfigPath string. Internal call sites all migrated; no external Go callers since this is a CLI binary.
• pkg/helm/findscore.go grew substantially with the ArtifactHub stars scoring change. This intersects with our helm_repo_exporter.go integration. The 3-way merge succeeded with no conflict markers; manual inspection confirms both feature sets coexist. Worth a careful read.
• Pre-existing Test_prepareOutput panic and 24 lint issues remain unchanged — same set already on main. PR fix(quality): test panic, PR-time CI, lint cleanup #146 clears them. Whoever lands second between fix(quality): test panic, PR-time CI, lint cleanup #146 and chore: sync with upstream FairwindsOps/nova #147 will need a small rebase.

How Has This Been Tested?

• go build ./... — clean
• golangci-lint run ./... — 24 issues (zero new vs main)
• go test ./... — same pre-existing Test_prepareOutput panic as main; everything else passes
• Module path verified to remain github.com/fairwindsops/nova

[gemini-code-assist]

Code Review

This pull request introduces support for a --kubeconfig flag, allowing users to specify custom configuration paths. It also refines the ArtifactHub matching logic by incorporating package 'stars' into the scoring system, expanding the preferred repositories list, and updating the scoring return type to float32. Additionally, the code has been modernized with Go 1.21+ features like slices.Contains and the any keyword. Review feedback highlighted a critical issue in how the kubeconfig path is loaded, suggesting the use of clientcmd instead of a local FlagSet. A significant bug was also identified in the scoring loop where capturing the address of a loop variable could lead to incorrect package matching.