docs(cli): correct why the single-run-ID invariant is untested

The WARNING on `runID := v1.GenerateRunID()` and the matching test comment
claimed the Action's two consumer sites "sit on mutually exclusive code
paths". They do not: with neither --snapshot nor --no-cluster, the
live-capture branch and runValidation both consume the same id in one
invocation — which is precisely the case the invariant protects. What
blocks a unit test is live-cluster I/O with no injectable seam in the
Action. This comment is the only protection for an untested invariant, so
a wrong mental model in it is worse than no comment.

Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

Author: ayuskauskas

pkg/cli/validate.go

@@ -859,12 +859,14 @@ constraint (e.g. K8s version) is not met — --fail-on-error scopes to phase che
 			// parseValidateAgentConfig call below, or for the
 			// validationConfig{runID: ...} literal further down — silently
 			// splits a single `aicr validate` invocation back into two
-			// uncorrelated runs. The command's two consumer sites
-			// (live-capture agent vs. validator Jobs) sit on mutually
-			// exclusive code paths (--no-cluster requires --snapshot, which
-			// skips the live-capture branch entirely), so no unit test can
-			// observe both consumers receiving the SAME value in one
-			// invocation without a live cluster; see
+			// uncorrelated runs. The two consumer sites are NOT mutually
+			// exclusive: with neither --snapshot nor --no-cluster, the
+			// live-capture branch below and runValidation both consume this
+			// id in the same invocation — which is exactly the case the
+			// invariant protects. What blocks a unit test is that reaching
+			// both requires live-cluster I/O (deployAgentForValidation
+			// deploys a Job; runValidation deploys validator Jobs) with no
+			// injectable seam here to fake it. See
 			// TestValidateAgentConfig_ToAgentConfig_ForwardsRunID and
 			// TestParseValidateAgentConfig_ForwardsCallerRunID in
 			// validate_test.go for what IS covered (passthrough at each

pkg/cli/validate_test.go

@@ -513,10 +513,11 @@ func TestValidateAgentConfig_ToAgentConfig_ForwardsRunID(t *testing.T) {
 // single-generation invariant (one v1.GenerateRunID() call feeding BOTH
 // the live-capture agent and the validator Jobs). See the WARNING comment
 // on that call site in validate.go: no automated test in this package
-// enforces single-generation, because the Action's two consumer sites sit
-// on mutually exclusive code paths (--no-cluster requires --snapshot,
-// which skips the live-capture branch entirely) and cannot both be
-// exercised in one invocation without a live cluster.
+// enforces single-generation. The two consumer sites are NOT mutually
+// exclusive — with neither --snapshot nor --no-cluster, the live-capture
+// branch and runValidation both consume the id in one invocation. What
+// blocks the test is that exercising both requires live-cluster I/O (both
+// branches deploy Jobs) with no injectable seam in the Action to fake it.
 func TestParseValidateAgentConfig_ForwardsCallerRunID(t *testing.T) {
 	const wantRunID = "20260821-142233-9f3a1c0b7e2d4a55"