feat(cli): auto-discover the client's namespace, rewrite the first-touch surface, ship a tb alias

[LukasWodka]

Summary

Fixes the CLI's out-of-box dead end and rewrites its first-touch surface, driven by a real session on a standard install (Lukas's Mac, client in its slug namespace):

$ tracebloc data list
Error: no tracebloc parent client release found in namespace "default" …
Install with `helm install <release> tracebloc/client --namespace default` first…

A working client was right there on the cluster — the CLI just never looked beyond the kubeconfig's default namespace, then told a customer to run Helm (the exact thing its own help promises they never do).

1. Namespace auto-discovery (§7.3)

• New cluster.FindClientNamespaces — cluster-wide scan for jobs-manager Deployments (same selector as single-namespace discovery).
• discoverRelease fallback in the shared resolve seam: a miss in the default namespace triggers the scan. Exactly one client → retarget with a visible note (· No client in namespace "default" — using the one in "tracebloc" …); several → named, pick via --namespace / client use; none or RBAC-denied scan → the original error stands.
• §7.5 guard: the scan never engages for an explicit --namespace/--context, and never for an active-client binding miss (that keeps the §7.3 "runs elsewhere" message — a stale binding must not silently retarget a different machine's client). Pinned by activeClientBinding.allowScan() + table test.
• cluster info now binds the active client exactly like the data commands — the pre-flight targets what data ingest will actually target, and the multi-client "set your active client" remediation works there too.

2. First-touch surface

• Root command: tagline + Long + home screen rewritten around the real scope (two contexts: your account / this machine's client); login leads Get started; POST /internal/… protocol jargon and issue links removed.
• ingest vs data ingest collision: validate moved to data validate; top-level ingest is a hidden deprecated alias, and tracebloc ingest <path> now redirects: did you mean tracebloc data ingest <path>.
• Error copy: --namespace → installer one-liner (https) → cluster doctor; never Helm. Sentinel renamed to no tracebloc client found; cluster doctor no longer advises running cluster doctor.
• Noun sweep: "parent (client) release" → client; vendors → other collaborators; PVC jargon out of Shorts/flag help; README command names updated to data ingest/data validate.

3. tb short alias (second commit)

The installers now ship tb next to the binary (symlink on Unix, tb.cmd shim on Windows; both skip if an unrelated tb exists). tb data ingest ./data. Requested by Lukas.

Verification

• Live on a real cluster (client in a non-default namespace): data list + cluster info auto-find it with the note; explicit -n default gets the new actionable error; invocation via a tb symlink verified.
• go build / go vet / full go test ./... green. New tests: scan (single/multi/none/explicit-no-scan), allowScan contract table, data validate + ingest validate alias resolution, updated string pins.
• Adversarially reviewed pre-push (multi-agent): findings folded — cluster-info binding parity, https on the curl|bash one-liner, doctor circularity, remaining noun stragglers.

Context: part of the CLI/installer UX pass with tracebloc/client#307 and the v2 spec (backend#992); complements cli#137/cli#138 (which cover client create auto-naming and the login/status contract).

🤖 Generated with Claude Code

[saadqbal]

Reviewed and pushed a couple of small fixes (31e8a1f):

• cluster info was printing the namespace field before the fallback scan retargets it — so it'd show default while the Client-install section below showed the real slug namespace. Moved it after the retarget.
• The tb alias wasn't actually best-effort on Windows: under $ErrorActionPreference='Stop' a Set-Content failure would abort the whole install (the third commit only hardened the Unix side). Wrapped it in try/catch, and tightened the "is this tb.cmd ours?" check from a loose *tracebloc.exe* substring to an exact match on our binary path.

Otherwise a clean, well-tested PR — the namespace-scan logic checks out. 👍