feat(cost): CI cost-guardrail — price manifest changes, flag/block PR $ deltas

[mayur-tolexo]

Implements the roadmap's CI cost-guardrail (Phase 2): a kubetidy cost command that prices a PR's resource-request changes — no cluster needed — so CI can say "this PR adds $400/mo" and optionally block it.

Usage

kubectl tidy cost ./manifests                          # total $/mo of a manifest set
kubectl tidy cost --base /tmp/base --head ./manifests  # diff before→after
kubectl tidy cost --base B --head H --fail-over 200    # exit non-zero if it adds > $200/mo
kubectl tidy cost --base B --head H -o json            # machine-readable

kubetidy cost · base → head

  this change adds $88/mo  ($27/mo → $116/mo)

  WORKLOAD                                       BEFORE      AFTER      DELTA
  Deployment/shop/checkout-api                      $27       $109       +$82  (changed)
  StatefulSet/shop/cache                              —         $7        +$7  (added)

How

• internal/manifest — pure YAML/JSON → []model.Workload parser (Deployment/StatefulSet/DaemonSet/ReplicaSet; requests normalized to millicores/bytes), plus CostWorkloads (× replicas, via costmodel) and Compare (added/removed/changed/unchanged + net delta).
• internal/cli/cost.go — cost [manifests…] or --base/--head (file or dir); table/json; --fail-over <budget> is the CI gate; --cpu-cost/--mem-cost overrides. Derived blended pricing (no cluster).
• docs/examples/cost-guardrail.yml — ready-to-copy GitHub Action: diffs base vs head via git worktree, comments the table on the PR, and enforces a budget. Kept under docs/ so it doesn't auto-run on this repo.

Tests

internal/manifest 86.1% (parser incl. DaemonSet defaults, namespace default, bad-YAML error; Compare add/remove/change). cost CLI: diff output, guardrail pass/fail, single-set total, no-input error. Full go build/vet/gofmt/test ./... + golangci-lint (0 issues) green.

Follow-ups

• Publish a real composite/Docker GitHub Action (uses: mayur-tolexo/kubetidy@v0) wrapping this.
• Cost from manifests vs the live cluster (what the PR changes relative to what's running).