feat(cli): add image management workflow

[Jinghao-coding]

Summary / 摘要

English

This PR adds the Crater CLI image and environment management workflow on top of the latest upstream/main. It keeps user image operations under crater image ..., moves platform/admin image operations under crater admin image ..., covers the image APIs that are part of the image domain, and hardens backend image ownership checks for user write operations.

中文

本 PR 基于最新 upstream/main 为 Crater CLI 增加镜像与环境管理工作流。用户侧镜像操作统一放在 crater image ...，平台管理员镜像操作统一放在 crater admin image ...；同时覆盖 image 域相关 API，并补齐后端用户写操作的镜像 owner 权限校验。

Added Commands / 新增命令

User image builds / 用户镜像构建

• crater image build ls
• crater image build get <name>
• crater image build template <name>
• crater image build pod <id>
• crater image build pip-apt --name NAME --tag TAG --image BASE ...
• crater image build dockerfile --name NAME --tag TAG (--dockerfile TEXT | --file PATH)
• crater image build envd --name NAME --tag TAG (--envd TEXT | --file PATH)
• crater image build remove --ids 1,2

User image records / 用户镜像记录

• crater image ls [--available] [--type TYPE] [--arch ARCH] [--visibility VISIBILITY] [--owner OWNER] [--search TEXT]
• crater image upload --image LINK [--type TYPE]
• crater image delete <id>
• crater image delete-many --ids 1,2
• crater image description <id> --description TEXT
• crater image type <id> --type TYPE
• crater image tags <id> --tags a,b
• crater image arch <id> --archs linux/amd64,linux/arm64
• crater image valid --links image-a,image-b

Sharing, CUDA, Harbor / 分享、CUDA、Harbor

• crater image share ls <image-id>
• crater image share users <image-id> [--name NAME]
• crater image share accounts <image-id>
• crater image share add <image-id> --share-type user|account --ids 1,2
• crater image share remove <image-id> --share-type user|account --target-id ID
• crater image cuda ls|add|delete
• crater image harbor info
• crater image harbor credential --yes
• crater image quota get|set --size BYTES

Admin image workflow / 管理员镜像流程

• crater admin image build-ls
• crater admin image build-remove --ids 1,2
• crater admin image ls
• crater admin image delete-many --ids 1,2
• crater admin image description <id> --description TEXT
• crater admin image type <id> --type TYPE
• crater admin image tags <id> --tags a,b
• crater admin image arch <id> --archs linux/amd64,linux/arm64
• crater admin image public <id>

Implementation Details / 实现说明

English

• Rebased the PR work onto the latest upstream/main and reused existing CLI shared helpers instead of reintroducing duplicate api_client, completion, response, and argument helpers.
• Split user and admin commands: admin APIs now use crater admin image ...; the PR no longer uses --admin or crater image admin ....
• Split task-type validation: all is valid only as a local list filter, not as a writable image task type.
• Added missing image API client coverage for build detail/template/pod, link validation, share grant listing, ungranted users/accounts, and available-image listing.
• Hardened backend image ownership checks for user delete, tag update, share, cancel share, grant listing, and ungranted user/account discovery.
• Added separate user/admin image skills and updated cli/docs/COMMANDS.md.

中文

• 将 PR 工作重放到最新 upstream/main，复用已有 CLI shared helper，不再重复引入 api_client、completion、response 和参数 helper。
• 拆分用户/管理员命令：管理员 API 统一使用 crater admin image ...，不再使用 --admin 或 crater image admin ...。
• 拆分任务类型校验：all 只允许作为本地列表过滤值，不允许写入镜像任务类型。
• 补齐 image API client 覆盖，包括构建详情/模板/Pod、镜像链接校验、分享对象查询、未授权用户/账户查询和 available image 列表。
• 后端补齐用户写操作的 image owner 校验，覆盖删除、标签更新、分享、取消分享、分享对象查询和候选分享对象查询。
• 拆分用户/管理员 image skill，并更新 cli/docs/COMMANDS.md。

Test Coverage / 测试覆盖

Added/updated tests / 新增或更新测试

• cli/test/snapshots/image/image_test.go
• cli/testdata/snapshots/image/image.en.txtar
• cli/testdata/snapshots/image/image.zh-CN.txtar
• cli/test/snapshots/read/read_matrix_test.go

Snapshot cases cover / 快照覆盖场景

• Unknown image subcommand.
• Missing build fields and missing Dockerfile/envd content.
• Invalid envd build source.
• Missing upload image link.
• Invalid ID and ID list parsing.
• Sharing validation and grant query API paths.
• Harbor credential confirmation.
• CUDA add validation.
• Admin image help coverage and admin API 404 paths.
• API 404 paths for list, available list, pip/apt build, share listing, and admin image list.

Verification / 验证

• GOCACHE=/private/tmp/crater-go-cache go test ./... (cli)
• GOCACHE=/private/tmp/crater-go-cache go test ./test/snapshots/image (cli)
• GOCACHE=/private/tmp/crater-go-cache go test ./test/snapshots/read (cli)
• make lint (backend)
• make lint-diff (backend)
• go test ./internal/handler/operations ./internal/bizerr ./internal/resputil (backend)
• go build ./cmd/crater/main.go (backend)
• make docs (backend)

Notes / 备注

English

This PR focuses on image/environment management only. Job creation, dataset management, and approval-order workflows remain in their dedicated PRs.

中文

本 PR 仅聚焦镜像/环境管理。作业创建、数据集管理和审批工单工作流仍由各自独立 PR 处理。

[Jinghao-coding]

@AkashiSensei 已按前几个 CLI PR 的 review 约定重做这一版 image workflow（最新提交 73e94e46），并更新了 PR 描述。

主要调整：

1. 基于最新 upstream/main 重放实现

   • 不再重复引入 api_client.go、completion_helpers.go、response.go 和通用参数 helper。
   • 复用主线已有 CLI shared helpers，解决原 PR mergeStateStatus=DIRTY 的冲突来源。

2. 管理员命令统一迁到 crater admin image ...

   • 用户侧保留 crater image ...。
   • 管理员侧新增 crater admin image build-ls/build-remove/ls/delete-many/description/type/tags/arch/public。
   • 不再使用 --admin 或 crater image admin ...。

3. 补齐 image API 覆盖

   • 补充 build detail/template/pod、link validation、share grants、ungranted users/accounts、available image 等 API。
   • image ls --available 保留已合入 read CLI 的语义。

4. 后端权限边界加固

   • 普通用户 delete/tags/share/cancel share/grant query/ungranted user-account query 都会先校验 image owner。
   • 避免 CLI 暴露后用户通过 image ID 操作他人镜像。

5. 校验和文档/Skill 同步

   • all 只允许作为 image ls --type all 的过滤值，不允许写入 image task type。
   • 所有无位置参数命令补 noArgs，有 ID 的命令使用 exactArgs。
   • 拆分用户 skill crater-cli-image-management 和管理员 skill crater-cli-admin-image-management。
   • 更新 cli/docs/COMMANDS.md、image snapshots 和 read matrix。

本地验证：

• GOCACHE=/private/tmp/crater-go-cache go test ./...（cli）
• GOCACHE=/private/tmp/crater-go-cache go test ./test/snapshots/image（cli）
• GOCACHE=/private/tmp/crater-go-cache go test ./test/snapshots/read（cli）
• make lint（backend）
• make lint-diff（backend）
• go test ./internal/handler/operations ./internal/bizerr ./internal/resputil（backend）
• go build ./cmd/crater/main.go（backend）
• make docs（backend）