CI/CD Phase 4: kind install testing

[patrick-hermann-sva]

Part of the CI/CD roadmap. See docs/ci-cd-roadmap.md (added in #10).

Goal

Prove a package installs + reconciles on a real Crossplane control plane — the gap verify (render-only) can't cover.

Scope

• kind create → helm-install Crossplane → install dependsOn providers/functions → install the Configuration from ttl.sh preview (PR) or ghcr (release) → assert: package Healthy=True, XRD Established, min XR composes (SYNCED=True, expected managed resource created with correct patched fields).
• Depth: most configs can't fully provision in kind (vsphere-vm→vCenter, ansible-run→Tekton+target). Assert up to managed-resource creation, not full readiness. Optionally stand up cheap backends (e.g. Tekton).
• Gating: pulls Crossplane + functions/KCL from ghcr (transient 502s seen) → retries/backoff + gate behind a label (needs-kind) or release-only, not every PR push.

Would auto-catch two classes of bug hit by hand: short-function-name package-lock collisions, and EnvironmentConfig label collisions (got 2).

Decisions

• Depth (install-only → compose-assert → mocked-backends).
• Trigger gating (every PR vs labeled vs release-only).
• Per-config skip/mock matrix.

Acceptance

• A gated job spins up kind, installs package + deps, asserts XRD-established + min-XR-composes per targeted config; failures identify the stage.

Dependencies

Consumes Phase 1 (PR previews) and/or Phase 3 (ghcr artifacts); can start with a manual/static install target.