Summary

Extends AICRConfig with spec.snapshot.* so aicr snapshot --config aicr-config.yaml works without bare CLI flags, mirroring the existing config support on recipe, bundle, and validate.

Motivation / Context

pkg/cli/snapshot.go did not read --config, so config-driven CUJ demos (e.g. demos/cuj1-gke-config.md) still had to pass --namespace, --node-selector, and --toleration as bare CLI flags for the snapshot step while the rest of the pipeline was config-driven. This broke the "one file drives the whole flow" property.

Fixes: #913
Related: N/A

Type of Change

• New feature (non-breaking change that adds functionality)
• Documentation update

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• Core libraries (pkg/errors, pkg/k8s) — pkg/config
• Docs/examples (docs/, examples/)

Implementation Notes

• New SnapshotSpec in pkg/config/config.go with output, agent, execution sub-sections, mirroring the shape of ValidateSpec. The agent block reuses the same nil-vs-explicitly-empty semantics for nodeSelector and tolerations (omit → inherit; [] → clear the tolerate-all default).
• (*SnapshotSpec).Resolve() converts wire-string form to a typed SnapshotResolved once at the boundary; CLI overrides layer on top via the existing stringFlagOrConfig / boolFlagOrConfig / stringSliceFlagOrConfig / durationFlagOrConfig / intFlagOrConfig helpers — same pattern as recipe, bundle, and validate.
• Snapshot CLI action refactored to extract parseSnapshotCmdOptions(cmd, cfg) (mirroring parseBundleCmdOptions) so tests can capture the merged result without touching the deploy path.
• Behavior preserved: when neither CLI nor config sets tolerations, the resolver falls back to snapshotter.DefaultTolerations() (tolerate all) — matching the legacy aicr snapshot default. This is verified by TestSnapshotCmd_FlagsAloneDefaultsTolerateAll.
• Privileged is a *bool in SnapshotExecutionSpec so an operator running in PSS-restricted namespaces can set privileged: false without the CLI flag's default-true silently re-enabling it.
• Demo demos/cuj1-gke-config.md updated to use aicr snapshot --config aicr-config.yaml (no more bare flags); removed the implicit issue-tracking note.

Testing

make qualify

Coverage delta on affected packages:

• pkg/cli: 63.7% → 66.5% (+2.8%)
• pkg/config: 93.7% → 93.8% (+0.1%)

New tests:

• pkg/config/resolve_test.go — SnapshotResolve_*: nil receiver, empty spec, all fields, zero/invalid/negative timeout, invalid tolerations, defensive map/slice clone, nil-vs-explicitly-empty, Privileged pointer semantics, negative maxNodesPerEntry.
• pkg/config/config_test.go — Validate_SnapshotOnly, Validate_InvalidSnapshot{Timeout,Format,Tolerations}, Validate_NegativeSnapshotMaxNodesPerEntry, plus the updated none of test now covers spec.snapshot.
• pkg/config/loader_test.go — TestLoad_RejectsUnknownSnapshotField guards the strict-decode path.
• pkg/cli/snapshot_config_test.go (new) — --config flag wiring, FlagsAloneStillWork, FlagsAloneDefaultsTolerateAll, AllConfigSectionsResolve, ConfigOnly_NoCLIFlags, FlagOverridesEverySection, ConfigEmptyTolerationsOptOut, InvalidConfig_* (bad timeout/format/unknown field/bad resources), RequireGPURuntimeClass_StillMutuallyExclusive, ConfigPrivilegedFalseHonored, NoConfigPrivilegedDefaultsTrue, ToAgentConfig translation pin.

Risk Assessment

• Low — Additive: new optional spec.snapshot section. No existing CLI flags removed or renamed. Strict-decode rejection unaffected since the new fields are added to the schema in the same change.

Rollout notes: Backwards-compatible. Existing aicr snapshot invocations without --config continue to work unchanged.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)