This pull request introduces several improvements to how the system h…

…andles Docker volume mounts, particularly addressing the issue where Docker may create directories instead of files when mounting non-existent paths. It adds robust validation and correction logic for mount sources, improves error handling and user guidance for certificate and config file issues, and enhances cross-platform compatibility (including WSL2). Additionally, it expands the set of allowed commands in the local settings.

**Docker Volume Mount Validation and Correction:**

* Added `EnsureVolumeMountSource` logic to both `LocalDockerClient` and `FallbackDockerEngine` to validate and fix mount sources before container creation, preventing Docker from creating directories where files are expected. If a file is expected but a directory exists, it is removed and appropriate errors are thrown if the file is missing. Parent directories are ensured to exist. [[1]](diffhunk://#diff-5fdd4262d38a2b718aa5e00ef044bebea66ac0d4e7ce0123e98534422f0846c6R17-R26) [[2]](diffhunk://#diff-5fdd4262d38a2b718aa5e00ef044bebea66ac0d4e7ce0123e98534422f0846c6R173-R220) [[3]](diffhunk://#diff-e1d8d7d634416e1da81c82007743b22561a011a7db50ed1543e20f1cbc653be9R28-R37) [[4]](diffhunk://#diff-e1d8d7d634416e1da81c82007743b22561a011a7db50ed1543e20f1cbc653be9R66-R113)

**Certificate and Config File Handling Improvements:**

* Enhanced logic in `ReverseProxyClient` and `UpdateClustersCommand` to handle cases where certificate paths are directories instead of files, including fallback to shell commands (with sudo if needed) for removal on systems like WSL2 or Mac. Improved error messages guide the user to resolve permission issues. [[1]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0L112-R114) [[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0L125-R189) [[3]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0R422) [[4]](diffhunk://#diff-507a2cb5a9de8de3cd705c5122826fbc47252c0a8920b902d50fb7b219e56c16L423-R423) [[5]](diffhunk://#diff-507a2cb5a9de8de3cd705c5122826fbc47252c0a8920b902d50fb7b219e56c16L439-R508)
* In `DockerHubClient`, added logic to ensure the `ConfigMounts` directory exists, remove incorrectly created directories for config files, and create or copy a default config if missing.

**User Guidance and Error Messaging:**

* Improved error messages for missing certificate files, including suggestions for copying certificates from `.bin/Certs` to the project root and clarifying expected file locations. [[1]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0R88-R89) [[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0R422)

**Cross-Platform and WSL2 Support:**

* Updated comments and logic to explicitly mention and support WSL2 environments, not just Mac, for Docker directory issues. [[1]](diffhunk://#diff-507a2cb5a9de8de3cd705c5122826fbc47252c0a8920b902d50fb7b219e56c16L423-R423) [[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0L112-R114)

**Local Settings Update:**

* Expanded the list of allowed commands in `.claude/settings.local.json` to include `grep`, `dotnet build`, `dotnet test`, and generic `test` commands, as well as web fetches from `github.com`.

Make FallbackDockerEngine tests safe to run on machines without Docke…

…r by checking connectivity in the test constructor and skipping tests when Docker is unavailable. Replaced [Fact] with [SkippableFact], added Skip.IfNot(_dockerAvailable, ...) to each test, and only pull the test image when Docker can be reached. Added a using Xunit and added the Xunit.SkippableFact package to the test project so tests can be conditionally skipped.

Detect and remove incorrectly-created certificate directories (common…

… on Mac when Docker mounts missing paths) and validate certificate files before use. Add Validate/Fix helpers in UpdateClustersCommand and ReverseProxyClient, update reverse proxy creation to restart a stopped proxy or create it with proper file mappings, and restart the proxy when configs change. Expose Restart on IDockerEngine and implement it in FallbackDockerEngine and LocalDockerClient. Also switch Docker container lookups to use name filters/NAMES instead of the vega-component label, fix async removal/start calls, adjust CoreDNS rewrite insertion to before the kubernetes block, and update tests. Minor change: update registry image reference to ghcr.io/project-zot/zot:v2.1.0.

This pull request introduces improvements to the Kubernetes cluster c…

…reation process and enhances the robustness of the Flux deployment workflow. The main changes include updating the default Kubernetes version, ensuring proper configuration file handling for containerd, and adding a mechanism to wait for all Flux kustomizations to be ready before proceeding.

**Cluster creation and configuration improvements:**

* The default Kubernetes API version used in the `CreateClusterCommand` has been updated from `1.29` to `1.32` to ensure clusters are created with a more recent version.
* The `hosts.toml` file for containerd registry configuration is now written to a temporary file location, ensuring Docker can reliably access it regardless of the working directory. All references to this file in the cluster setup process have been updated to use the temporary path. [[1]](diffhunk://#diff-a79e3fb79a02ff8c7ccb140e044c5a1667d150342017588caddbe43e8fb158d9R114-R123) [[2]](diffhunk://#diff-a79e3fb79a02ff8c7ccb140e044c5a1667d150342017588caddbe43e8fb158d9L130-R140) [[3]](diffhunk://#diff-a79e3fb79a02ff8c7ccb140e044c5a1667d150342017588caddbe43e8fb158d9L147-R157)

**Flux deployment reliability:**

* A new method, `WaitForKustomizations`, has been added to the `FluxClient` service. This method polls the Flux API to ensure all kustomizations are reconciled and ready before proceeding, improving the reliability of post-deployment configuration steps. The `CreateClusterCommand` now calls this method after bootstrapping Flux. [[1]](diffhunk://#diff-d5f2700d720818c1cf0dc9152984eb5b6675c2f6c84876230dca8734ea33b229R120-R204) [[2]](diffhunk://#diff-a79e3fb79a02ff8c7ccb140e044c5a1667d150342017588caddbe43e8fb158d9R207-R210) [[3]](diffhunk://#diff-5523bfe8fb59e0d9a562f336b10cf3471427f6c263a594f4037c29d9cd3f5962R6)

**Development tooling:**

* The `.claude/settings.local.json` file has been updated to allow additional Bash commands related to Docker, Kubernetes, and shell scripting, supporting more flexible local development and automation.

Updated all major documentation files to reflect the new Vega CLI nam…

…ing, commands, and workflows. Added detailed instructions for installation, development setup, troubleshooting, cluster creation, management, and contribution guidelines. Improved clarity, structure, and completeness of docs to support new features and user onboarding.

This pull request introduces several infrastructure and configuration…

… improvements for the VDK platform, focusing on updating the registry implementation, enhancing reverse proxy support, and improving cluster configuration management. The most significant changes include switching the registry to use Zot with persistent storage, updating Nginx reverse proxy configurations to support WebSocket upgrades, and adding mechanisms to regenerate proxy configs for all clusters. These changes aim to improve reliability, maintainability, and feature support for VDK clusters.

**Registry and Storage Updates**
* The registry image is switched from Docker Hub's `registry:2` to Zot (`ghcr.io/project-zot/zot-linux-amd64:v2.1.0`), and the registry port mapping is changed to use port 5000 for both container and host. Persistent storage is configured via a new `zot-config.json` file, and registry data is mounted to a local `images` directory for durability. (`[[1]](diffhunk://#diff-10766307bf50935bff9102c340a577a8264619e2daf28f12caeb31552f7b7a95L6-R10)`, `[[2]](diffhunk://#diff-f85289aeac82c81bfbc724e38a8fc85b334d41fbb1853eed00bc6248f0650ed1R1-R27)`, `[[3]](diffhunk://#diff-3726b6665f5ed1b85bfd6508820f0251a9b63b6fe922b17c9e136636b39d8e8cL11-R34)`, `[[4]](diffhunk://#diff-7a605576fe39e3faf502fbfe6918199774b6f60dd9e0781687279da37b239f7bR43-R49)`)
* Registry creation now ensures the images directory exists and mounts both the config and images directories into the container for proper configuration and persistence. (`[[1]](diffhunk://#diff-3726b6665f5ed1b85bfd6508820f0251a9b63b6fe922b17c9e136636b39d8e8cL11-R34)`, `[[2]](diffhunk://#diff-7a605576fe39e3faf502fbfe6918199774b6f60dd9e0781687279da37b239f7bR43-R49)`)

**Reverse Proxy and Nginx Enhancements**
* The Nginx proxy image is updated to a specific version (`nginx:1.27`), and the configuration is enhanced to support WebSocket upgrades by adding relevant headers and protocol support in the generated server blocks. (`[[1]](diffhunk://#diff-10766307bf50935bff9102c340a577a8264619e2daf28f12caeb31552f7b7a95L6-R10)`, `[[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0R178-R182)`, `[[3]](diffhunk://#diff-a8d5ba0615ccd8881334ac02ada00b38a5cc34d536d57ee11a5fcfb72b5b5469R1-R42)`)
* A new method `RegenerateConfigs()` is added to the reverse proxy client interface and implementation, allowing regeneration of Nginx configs for all clusters, which is useful for applying changes like WebSocket support. (`[[1]](diffhunk://#diff-e08745d347c74a2102df8d7e85be56f4bb79929e13826790a0a86e036017a5eeR16-R21)`, `[[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0R423-R459)`)

**Cluster Management Improvements**
* The `UpdateClustersCommand` now accepts an `IReverseProxyClient` and invokes Nginx config regeneration after cluster certificate updates, ensuring proxy configs stay in sync with cluster changes. (`[[1]](diffhunk://#diff-507a2cb5a9de8de3cd705c5122826fbc47252c0a8920b902d50fb7b219e56c16R16-R30)`, `[[2]](diffhunk://#diff-507a2cb5a9de8de3cd705c5122826fbc47252c0a8920b902d50fb7b219e56c16R78-R91)`)

**Configuration and Permissions**
* New local settings and permissions are defined in `.claude/settings.local.json` to allow specific Docker operations, supporting the updated registry and proxy workflows. (`[.claude/settings.local.jsonR1-R8](diffhunk://#diff-fca16cae5b0e32edfa6b55eaa32a98ffbf4a0c7d885fb585785fc83b6ea2d9c3R1-R8)`)

These updates collectively modernize the registry and proxy setup, improve cluster management workflows, and lay the groundwork for more robust and featureful VDK deployments.

This pull request introduces a new `UpdateClustersCommand` to the CLI…

…, enabling automated updating of TLS certificates across all VDK-managed Kubernetes clusters and restarting relevant gateway deployments if changes are detected. The command is integrated into the update command group and registered in the dependency injection system. Minor improvements are also made to existing update commands.

**New cluster certificate update functionality:**

* Added `UpdateClustersCommand` to automate checking and updating TLS certificates in all VDK clusters, updating only Vega-managed secrets, and triggering gateway restarts when secrets are updated. Includes verbose/debug output and robust error handling. (`cli/src/Vdk/Commands/UpdateClustersCommand.cs`)

**CLI integration and registration:**

* Registered `UpdateClustersCommand` in the dependency injection container for use throughout the CLI. (`cli/src/Vdk/ServiceProviderBuilder.cs`)
* Added `UpdateClustersCommand` as a subcommand under the main `UpdateCommand`, making it accessible via the CLI. (`cli/src/Vdk/Commands/UpdateCommand.cs`)

**Minor improvements:**

* Added the alias `k8s` to the `UpdateKindVersionInfoCommand` for improved usability. (`cli/src/Vdk/Commands/UpdateKindVersionInfoCommand.cs`)

This pull request upgrades the project to .NET 10 and updates service…

… references related to the reverse proxy client. The main changes include updating target frameworks and workflow configuration, as well as switching from the `ingress-nginx-controller` service to `kgateway-system-kgateway` in the codebase.

**.NET Version Upgrade:**

* Updated target framework to `net10.0` in `cli/src/Vdk/Vdk.csproj` and `cli/tests/Vdk.Tests/Vdk.Tests.csproj`. [[1]](diffhunk://#diff-7a605576fe39e3faf502fbfe6918199774b6f60dd9e0781687279da37b239f7bL1-R5) [[2]](diffhunk://#diff-54ae04b42e61e9966f7f7c73a549a4808ecaa215cc4e374c3928112aa06e9cf2L4-R4)
* Updated the GitHub Actions workflow in `.github/workflows/build.yaml` to use .NET version `10.0.x` for builds.

**Reverse Proxy Service Reference Update:**

* Changed all references in `PatchCoreDns` (in `ReverseProxyClient.cs`) from `ingress-nginx-controller` to `kgateway-system-kgateway`, including log messages and service lookups.

This pull request introduces significant enhancements to the `Reverse…

…ProxyClient` class, primarily focusing on improving Kubernetes cluster management by adding functionality for patching CoreDNS configurations and handling TLS secrets. Additionally, it updates the corresponding test suite to ensure comprehensive coverage of the new functionality.

### Core Functionality Enhancements:
* Added the `PatchCoreDns` method to dynamically update CoreDNS configurations for new clusters by adding rewrite entries and restarting CoreDNS pods. This ensures that DNS entries for clusters are properly configured.
* Introduced the `CreateTlsSecret` method to handle TLS secret creation for clusters, with improved error handling and early exits when conditions are not met. [[1]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0L207-R319) [[2]](diffhunk://#diff-9d1551a1e1d10111597a0613aa1f7ec2f1344744ae1109d317638f89241412e0L232-R344)
* Updated the `UpsertCluster` method to integrate the new `PatchCoreDns` and `CreateTlsSecret` methods, streamlining cluster setup and configuration.

### Refactoring and Code Quality:
* Refactored variable and mock names in `ReverseProxyClientTests` for clarity (`_k8sMock` renamed to `_kubeClientMock`).

### Unit Test Additions:
* Added multiple unit tests in `ReverseProxyClientTests` to validate the behavior of `PatchCoreDns`, covering scenarios such as missing ingress services, missing CoreDNS config maps, and successful updates with pod restarts. These tests ensure robustness and reliability of the new functionality.

This pull request introduces a fallback mechanism for Docker operatio…

…ns, updates dependencies, and includes various enhancements to improve reliability and maintainability. Key changes include the addition of a `FallbackDockerEngine` for handling Docker failures, updates to the `IDockerEngine` interface and its implementations, and dependency version upgrades. Unit tests for the fallback functionality have also been added.

### Fallback mechanism for Docker operations:
* Introduced a new `FallbackDockerEngine` class to provide a fallback implementation of `IDockerEngine` when the primary Docker connection fails. This includes methods for container management (e.g., `Run`, `Stop`, `Delete`) and a helper method to run Docker CLI commands. (`cli/src/Vdk/Services/FallbackDockerEngine.cs`)
* Updated the `Build` method in `ServiceProviderBuilder` to include intelligent fallback logic for selecting `FallbackDockerEngine` when Docker connectivity issues are detected. (`cli/src/Vdk/ServiceProviderBuilder.cs`)

### Enhancements to `IDockerEngine` interface and implementations:
* Added a `CanConnect` method to the `IDockerEngine` interface to check Docker connectivity. (`cli/src/Vdk/Services/IDockerEngine.cs`)
* Implemented the `CanConnect` method in `LocalDockerClient` to verify connectivity using the Docker API. (`cli/src/Vdk/Services/LocalDockerClient.cs`)

### Dependency updates:
* Upgraded several package dependencies, including `KubeOps.KubernetesClient` (to version 9.10.0), `Microsoft.Extensions.DependencyInjection` (to version 9.0.7), and `YamlDotNet` (to version 16.3.0), among others. (`cli/src/Vdk/Vdk.csproj`)

### Configuration changes:
* Updated the `RegistryHostPort` constant in `Containers.cs` from `5000` to `50000` to avoid potential port conflicts. (`cli/src/Vdk/Constants/Containers.cs`)

### Unit tests for fallback functionality:
* Added comprehensive tests for the `FallbackDockerEngine` class to verify container operations (`Run`, `Stop`, `Delete`, etc.) and ensure proper handling of ports and volumes. (`cli/tests/Vdk.Tests/FallbackDockerEngineTests.cs`)