feat: add aggressive kueue gating and enhanced verbose output

Replace 6 per-resource-type kueue label checks with a single
DataIntegrityCheck that validates three cluster-wide invariants:

1. Every workload in a kueue-managed namespace has the queue-name label
2. Every workload with the queue-name label is in a kueue-managed namespace
3. Within each top-level CR's ownership tree, all resources agree on the
   queue-name label value

Key design decisions:

- Top-down traversal from monitored CRs (Notebook, InferenceService,
  LLMInferenceService, RayCluster, RayJob, PyTorchJob) through an
  ownership graph of intermediate types (Deployment, StatefulSet,
  ReplicaSet, DaemonSet, Job, CronJob, Pod)
- Ownership graph built once per namespace and reused across all CRs
- Single KueueConsistency condition (True/False) with aborting impact
- First-violation-wins per CR to avoid redundant diagnostics
- ImpactedObjects populated with TypeMeta for consistency with other checks
- Pre-filter to only process kueue-relevant namespaces (union of
  kueue-managed namespaces and namespaces with kueue-labeled workloads)

Introduces ImpactAborting as the highest severity level ("aborting"),
representing conditions where an upgrade MUST NOT proceed. The kueue
data-integrity check uses this impact to gate upgrades when label
inconsistencies are detected.

Fatal severity support:

- New SeverityLevelFatal filter level for --severity flag
- Fatal banner (box-drawn border) rendered above the summary table
  when any aborting conditions are detected, listing all fatal findings
- Double exclamation mark (‼) status icon for fatal conditions
- Bold "fatal" severity label (other severities remain non-bold)
- FATAL verdict in output when aborting conditions are present
- FilterBySeverity updated to support fatal-only filtering

Refactors NotebookVerboseFormatter into a centrally defined
EnhancedVerboseFormatter in pkg/lint/check/:

- Handles mixed resource types by deriving per-object CRD FQN from
  TypeMeta, with annotation preference for single-kind results
- Exports CRDFullyQualifiedName and DeriveCRDFQNFromTypeMeta helpers
- Supports optional per-object context via AnnotationObjectContext,
  rendered as a sub-bullet beneath each impacted object reference
- Notebook checks updated to embed check.EnhancedVerboseFormatter
- Kueue DataIntegrityCheck embeds EnhancedVerboseFormatter for
  CRD-qualified verbose output across its 6 monitored resource types,
  with per-object context indicating which invariant was violated

Adds resource type definitions for StatefulSet, ReplicaSet, DaemonSet,
Job, and CronJob. Updates ToPartialObjectMetadata helper to preserve
UID and OwnerReferences needed for ownership graph construction.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

Author: andyatmiami

pkg/lint/check/result/result.go

@@ -16,6 +16,12 @@ const (
 	// (e.g., "notebooks.kubeflow.org"). Automatically set by SetImpactedObjects and
 	// AddImpactedObjects from the ResourceType.
 	AnnotationResourceCRDName = "resource.opendatahub.io/crd-name"
+
+	// AnnotationObjectContext is an optional per-object annotation key that provides
+	// brief clarifying context about why a specific object is impacted. When set on
+	// an ImpactedObject's ObjectMeta.Annotations, the EnhancedVerboseFormatter renders
+	// it as a sub-bullet beneath the object reference.
+	AnnotationObjectContext = "result.opendatahub.io/context"
 )
 
 const (
@@ -33,8 +39,9 @@ const (
 // Impact represents the upgrade impact level of a diagnostic condition.
 type Impact string
 
-// Impact levels for diagnostic conditions.
+// Impact levels for diagnostic conditions, ordered by severity (highest first).
 const (
+	ImpactAborting Impact = "aborting" // Upgrade MUST NOT proceed
 	ImpactBlocking Impact = "blocking" // Upgrade CANNOT proceed
 	ImpactAdvisory Impact = "advisory" // Upgrade CAN proceed with warning
 	ImpactNone     Impact = ""         // No impact (omitted from JSON/YAML)
@@ -71,16 +78,16 @@ func (c Condition) Validate() error {
 		// False/Unknown status must have impact specified.
 		if c.Impact == ImpactNone || c.Impact == "" {
 			return fmt.Errorf(
-				"condition with Status=%q must have Impact specified (Blocking or Advisory), got Impact=%q",
+				"condition with Status=%q must have Impact specified (Aborting, Blocking, or Advisory), got Impact=%q",
 				c.Status, c.Impact,
 			)
 		}
 
 		// Validate impact values.
-		if c.Impact != ImpactBlocking && c.Impact != ImpactAdvisory {
+		if c.Impact != ImpactAborting && c.Impact != ImpactBlocking && c.Impact != ImpactAdvisory {
 			return fmt.Errorf(
-				"invalid Impact=%q, must be %q or %q",
-				c.Impact, ImpactBlocking, ImpactAdvisory,
+				"invalid Impact=%q, must be %q, %q, or %q",
+				c.Impact, ImpactAborting, ImpactBlocking, ImpactAdvisory,
 			)
 		}
 
@@ -254,10 +261,14 @@ func (r *DiagnosticResult) GetImpact() Impact {
 
 	for _, cond := range r.Status.Conditions {
 		switch cond.Impact {
+		case ImpactAborting:
+			return ImpactAborting
 		case ImpactBlocking:
-			return ImpactBlocking
+			maxImpact = ImpactBlocking
 		case ImpactAdvisory:
-			maxImpact = ImpactAdvisory
+			if maxImpact == ImpactNone {
+				maxImpact = ImpactAdvisory
+			}
 		case ImpactNone:
 			// No impact - continue checking other conditions
 		}

pkg/lint/check/result/result_test.go

@@ -307,6 +307,53 @@ func TestDiagnosticResult_Validate_EmptyConditionReason(t *testing.T) {
 	g.Expect(err.Error()).To(ContainSubstring("has empty reason"))
 }
 
+func TestConditionValidate_AbortingWithStatusFalse(t *testing.T) {
+	g := NewWithT(t)
+
+	cond := result.Condition{
+		Condition: metav1.Condition{
+			Type:   "Consistency",
+			Status: metav1.ConditionFalse,
+			Reason: "Inconsistent",
+		},
+		Impact: result.ImpactAborting,
+	}
+
+	g.Expect(cond.Validate()).ToNot(HaveOccurred())
+}
+
+func TestConditionValidate_AbortingWithStatusUnknown(t *testing.T) {
+	g := NewWithT(t)
+
+	cond := result.Condition{
+		Condition: metav1.Condition{
+			Type:   "Consistency",
+			Status: metav1.ConditionUnknown,
+			Reason: "CannotDetermine",
+		},
+		Impact: result.ImpactAborting,
+	}
+
+	g.Expect(cond.Validate()).ToNot(HaveOccurred())
+}
+
+func TestConditionValidate_AbortingWithStatusTrue_Invalid(t *testing.T) {
+	g := NewWithT(t)
+
+	cond := result.Condition{
+		Condition: metav1.Condition{
+			Type:   "Consistency",
+			Status: metav1.ConditionTrue,
+			Reason: "Consistent",
+		},
+		Impact: result.ImpactAborting,
+	}
+
+	err := cond.Validate()
+	g.Expect(err).To(HaveOccurred())
+	g.Expect(err.Error()).To(ContainSubstring("Status=True must have Impact=None"))
+}
+
 // T023: Multiple conditions array tests
 
 func TestMultipleConditions_OrderedByExecutionSequence(t *testing.T) {
@@ -790,6 +837,103 @@ func TestSetCondition_MultipleConditionTypes(t *testing.T) {
 	}))
 }
 
+// GetImpact tests
+
+func TestGetImpact_ReturnsAbortingAsHighest(t *testing.T) {
+	g := NewWithT(t)
+
+	dr := result.New("workload", "kueue", "data-integrity", "test")
+	dr.SetCondition(check.NewCondition(
+		"Advisory",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("advisory finding"),
+		check.WithImpact(result.ImpactAdvisory),
+	))
+	dr.SetCondition(check.NewCondition(
+		"Blocking",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("blocking finding"),
+		check.WithImpact(result.ImpactBlocking),
+	))
+	dr.SetCondition(check.NewCondition(
+		"Aborting",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("aborting finding"),
+		check.WithImpact(result.ImpactAborting),
+	))
+
+	g.Expect(dr.GetImpact()).To(Equal(result.ImpactAborting))
+}
+
+func TestGetImpact_AbortingShortCircuits(t *testing.T) {
+	g := NewWithT(t)
+
+	// Aborting condition first — should return immediately without checking others.
+	dr := result.New("workload", "kueue", "data-integrity", "test")
+	dr.SetCondition(check.NewCondition(
+		"Aborting",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("aborting finding"),
+		check.WithImpact(result.ImpactAborting),
+	))
+	dr.SetCondition(check.NewCondition(
+		"Passing",
+		metav1.ConditionTrue,
+		check.WithReason("Reason"),
+		check.WithMessage("all good"),
+	))
+
+	g.Expect(dr.GetImpact()).To(Equal(result.ImpactAborting))
+}
+
+func TestGetImpact_BlockingWithoutAborting(t *testing.T) {
+	g := NewWithT(t)
+
+	dr := result.New("component", "kserve", "removal", "test")
+	dr.SetCondition(check.NewCondition(
+		"Blocking",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("blocking finding"),
+		check.WithImpact(result.ImpactBlocking),
+	))
+	dr.SetCondition(check.NewCondition(
+		"Advisory",
+		metav1.ConditionFalse,
+		check.WithReason("Reason"),
+		check.WithMessage("advisory finding"),
+		check.WithImpact(result.ImpactAdvisory),
+	))
+
+	g.Expect(dr.GetImpact()).To(Equal(result.ImpactBlocking))
+}
+
+func TestGetImpact_NoneWhenAllPassing(t *testing.T) {
+	g := NewWithT(t)
+
+	dr := result.New("component", "dashboard", "status", "test")
+	dr.SetCondition(check.NewCondition(
+		"Available",
+		metav1.ConditionTrue,
+		check.WithReason("Ready"),
+		check.WithMessage("all good"),
+	))
+
+	g.Expect(dr.GetImpact()).To(Equal(result.ImpactNone))
+}
+
+func TestGetImpact_NoneWhenNoConditions(t *testing.T) {
+	g := NewWithT(t)
+
+	dr := result.New("component", "test", "check", "test")
+
+	g.Expect(dr.GetImpact()).To(Equal(result.ImpactNone))
+}
+
 // SetImpactedObjects and AddImpactedObjects tests
 
 func TestSetImpactedObjects(t *testing.T) {