Summary

Add CLI affordances for surgical edits to the per-node skyhook.nvidia.com/nodeState_<skyhook> annotation, and let kubectl skyhook reset target a single package version instead of being all-or-nothing.

Motivation

Today, recovering a single misbehaving package on a node requires either hand-editing the node-state annotation (error-prone JSON surgery) or resetting the entire Skyhook on that node, which re-runs every package. We need a supported, scriptable path for narrow recoveries.

Proposed changes

1. New command: kubectl skyhook update-state

kubectl skyhook update-state <skyhook-cr-name> <package> <version> <stage> <state> \
    [--node <node>... | --selector <label-selector>] \
    [--dry-run] [--confirm]

• All five positional args are required: CR, package, version, stage, state.
• <stage> accepts the documented lifecycle stages (apply, config, interrupt, post-interrupt, uninstall, upgrade, or their -check counterparts), per docs/operator-status-definitions.md.
• <state> accepts the documented values (complete, in_progress, skipped, erroring, unknown).
• Defaults to every node that already has state for the CR (same scoping as skyhook reset). --node / --selector narrow the target set; document the default behavior explicitly in --help and docs/cli.md.
• Validates that <package> and <version> exist on the referenced Skyhook CR; rejects edits that would produce an invalid State/Stage combination.

2. Extend kubectl skyhook reset with --package

kubectl skyhook reset <skyhook-cr-name> \
    [--package <name>[:<version>]]

• Without --package: current behavior (reset every package's state on every node with state for the CR).
• With --package <name>: remove only that package's entry from the node-state annotation.
• With --package <name>:<version>: only reset if the recorded version matches (no-op otherwise, with a clear message).

Acceptance criteria

• update-state and reset --package work against any currently supported operator version, with feature-detection + a clear error if the operator is too old (per docs/cli.md compat matrix).
• Both commands validate input against the Skyhook CR before patching.
• --dry-run prints the resulting annotation diff without applying it.
• Chainsaw e2e coverage under k8s-tests/chainsaw/cli/ for both happy-path and rejection cases.
• docs/cli.md updated with the new command, the new flag, and the compatibility matrix entry.
• operator/cmd/cli/CHANGELOG.md entry.

Out of scope

• Editing fields outside the node-state annotation (status conditions, finalizers, etc.).
• Bulk JSON-patch style edits — this is intentionally narrow.