feat(podspec): find PodSpecs structurally, validated by the Go types (option B)

[MPV]

Option B of the candidates for #26, raised side by side so they can be compared. Scope feat(podspec) finds the set — #81 #82 #83 #84 #106. Only one should be merged.

See also #106, which combines this PR with #84 — inference here, configured expressions for what inference cannot see. It reaches strictly more than this PR and, because configured kinds skip the walk, runs faster than it.

Rebased onto 2abd515 (0.4.3) — Kubernetes v0.36.3, Go 1.26.

	master	A · reflection	B · structural ← this	C · CUE	D · config	E · B+D
CR embedding a PodSpec (Argo Rollout)	✗	✗	✓ auto	✓ auto	✓ via config	✓ auto
CR with bare containers (Argo Workflow)	✗	✗	✗	✗	✓ via config	✓ via config
Can silence a wrong reading	✗	✗	✗	✗	n/a	✓
Rejects a containers lookalike	✓	✓	✓ strict decode	✓	✓	✓
1000 documents	144 ms	135 ms	171 ms	3058 ms	92 ms	107 ms
Binary	27.2 MB	27.2 MB	12.4 MB	25.4 MB	4.1 MB	12.6 MB
go.sum lines	74	74	72	109	42	78
Code generation	—	—	—	make schema	—	—
New CLI surface	—	—	—	--schema	--config	--config

One interleaved best-of-7 run; every variant emits the same 2000 images. Absolute timings drift with machine load between runs — the ratios are the stable quantity.

Approach

Stop decoding into typed Kubernetes objects. Decode each document into plain Go values, walk it, and test each node for PodSpec shape.

The shape test is the load-bearing part, and it is deliberately not a field-name heuristic: a candidate's containers / initContainers / ephemeralContainers are decoded into the real corev1 types with unknown fields rejected. The Kubernetes Go types are the schema, so a node matches when Kubernetes itself would call it a PodSpec.

What it buys

Custom resources work, which is the half of #26 option A cannot reach:

$ kir approvals/kir_test.TestCustomResource.input.yaml   # an Argo Rollout
my-registry/app:1.4.2
busybox:1.36

A checked-in fixture with a golden, so the example can't drift. List stops being a special case — its items are just more nodes — taking the kind allow-list and the unstructured item handling with it. ReplicationController and PodTemplate come along for free.

Dropping typed decoding drops k8s.io/client-go entirely: 27.2 MB → 12.4 MB. k8s.io/api stays, as the schema.

What it costs

• Precision rests on the strict decode. TestSkipsNonWorkloads.Lookalike pins it: a resource with a containers field holding non-containers yields nothing. Worth reviewing that fixture specifically — it is the guard against this approach going wrong.
• A CR holding bare containers is missed, since there is no PodSpec shape to match, and a user has no way to say otherwise. An Argo Workflow is the common case. This is the gap feat(podspec): infer images structurally, with configured overrides (option E) #106 closes.
• Bound to the vendored k8s.io/api: a container field newer than it fails the strict decode. In practice the binding is loose — this rebase carried Kubernetes v0.32.3 → v0.36.3, four minor versions, and moved no goldens and needed no code change.
• 144 ms → 171 ms over 1000 documents.

Notes for review

• The walk sorts map keys — without that, Go's randomised map iteration would make output order flake whenever a document holds more than one PodSpec. TestFindImagesOrderIsStable guards it.
• k8s/k8s_test.go is rewritten because the type switch it tested is gone. The replacement corpus is shared verbatim with option C, so the two engines are compared on identical cases.
• One golden changes: TestFailure.BadYAML's stderr gains an error converting YAML to JSON: prefix — same class, same exit 1, different parser wrapping the message. Shared with C, D and E.

gofmt, go vet, go mod tidy no-op, go test -race ./... green. ADR 0009 records the decision as proposed, superseding ADR 0001 only if merged.