Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/cli.md`:
- Around line 438-463: The example showing the package-specific reset is
redundant because --skip-batch-reset is already implied when using the reset
subcommand with --package; update the example under the "Surgical Recovery"
section so it either removes the redundant --skip-batch-reset flag (use "kubectl
skyhook reset my-skyhook --package my-package:1.0 --confirm") or keep the flag
but add a brief inline comment clarifying that --skip-batch-reset is shown for
explicitness but is implied by --package; ensure the change references the reset
command and the --package/--skip-batch-reset flags so reviewers can find the
sample to modify.

In `@k8s-tests/chainsaw/cli/reset-package/chainsaw-test.yaml`:
- Around line 20-22: Add an explicit metadata.labels.pool entry to the manifest
for the resource named cli-reset-package by adding a labels map under metadata
with pool set to the correct test-pool value (choose one of core, interrupt,
uninstall, lifecycle) that matches this test's cluster-state/runtime mutation
profile; ensure the label key is metadata.labels.pool and it sits alongside the
existing metadata.name entry for the cli-reset-package manifest.

In `@k8s-tests/chainsaw/cli/reset-package/skyhook.yaml`:
- Line 28: The image reference "ghcr.io/nvidia/skyhook-packages/shellscript" in
the skyhook.yaml manifest is not an allowed registry prefix; update the image
fields (the occurrences at the image lines, currently set to
ghcr.io/nvidia/skyhook-packages/shellscript) to use an approved prefix such as
ghcr.io/nvidia/skyhook/ or ghcr.io/nvidia/nodewright/ (e.g., move the package
under ghcr.io/nvidia/skyhook/<repo> or ghcr.io/nvidia/nodewright/<repo>),
ensuring all occurrences (including the one noted also at the other image line)
are changed to match the allowed registry prefixes.

In `@k8s-tests/chainsaw/cli/update-state-reject/chainsaw-test.yaml`:
- Around line 20-22: This Chainsaw test resource (metadata.name
"cli-update-state-reject") lacks a metadata.labels.pool, so add a labels section
under metadata with pool set to the appropriate mutation profile value (one of
core, interrupt, uninstall, lifecycle) that matches this test's
cluster-state/runtime mutation behavior; ensure the label key is
metadata.labels.pool and that it is present alongside the existing metadata.name
so the suite is routed by mutation-profile-based routing.

In `@k8s-tests/chainsaw/cli/update-state-reject/skyhook.yaml`:
- Around line 25-30: Update the Skyhook package manifest under
spec.packages.test-package to explicitly set uninstall.enabled and
uninstall.apply (e.g., add uninstall: { enabled: <true|false>, apply:
<true|false> } to test-package) and change the package image
(packages.test-package.image) to an allowed registry prefix (use
ghcr.io/nvidia/skyhook/* or ghcr.io/nvidia/nodewright/* instead of
ghcr.io/nvidia/skyhook-packages/...) so the CR conforms to the manifest policy.

In `@k8s-tests/chainsaw/cli/update-state/chainsaw-test.yaml`:
- Around line 20-22: The Test manifest for metadata.name "cli-update-state" is
missing the required metadata.labels.pool label used for pool routing; add a
metadata.labels.pool entry under the manifest's metadata (for example set pool:
core, interrupt, uninstall, or lifecycle) choosing the value that matches the
cluster/runtime mutation profile exercised by the "cli-update-state" test so
Chainsaw routes the e2e correctly.

In `@k8s-tests/chainsaw/cli/update-state/skyhook.yaml`:
- Around line 25-30: The package entry for "test-package" is missing explicit
uninstall fields and uses a disallowed image registry; update the package spec
by adding an uninstall block with uninstall.enabled set to true or false as
appropriate and uninstall.apply set to the command or script to run on uninstall
(use the same key names uninstall.enabled and uninstall.apply under the
test-package entry), and replace the image
ghcr.io/nvidia/skyhook-packages/shellscript with an allowed registry image under
either ghcr.io/nvidia/nodewright/* or ghcr.io/nvidia/skyhook/* (choose the
correct repository/name that provides the same shellscript functionality).

---

Outside diff comments:
In `@k8s-tests/chainsaw/cli/reset-package/skyhook.yaml`:
- Around line 21-42: Add an explicit spec.uninstall block to the Skyhook
manifest containing the uninstall.enabled and uninstall.apply fields so
uninstall behavior is deterministic; update the Skyhook CR that includes
packages pkg1 and pkg2 by adding e.g. spec.uninstall: enabled: true and apply:
true (or set the values required by the test) immediately under spec, ensuring
both uninstall.enabled and uninstall.apply are present for the manifest that
defines pkg1 and pkg2.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@k8s-tests/chainsaw/cli/reset-package/chainsaw-test.yaml`:
- Around line 22-23: The YAML uses an unsupported pool label value "pool: cli";
update the label under labels (the `pool` key) to one of the supported
mutation-profile values—core, interrupt, uninstall, or lifecycle—based on which
cluster-state or runtime mutation this test exercises (i.e., replace `pool: cli`
with the correct profile name).

In `@k8s-tests/chainsaw/cli/update-state-reject/chainsaw-test.yaml`:
- Around line 22-23: The manifest sets labels: pool: cli which is unsupported
for Chainsaw e2e tests; update the pool label value under labels (the `pool`
key) to the correct mutation-profile for this test (choose one of: core,
interrupt, uninstall, or lifecycle) — replace `cli` with the appropriate profile
(e.g., `interrupt` if this test exercises runtime interruption, otherwise pick
`core`, `uninstall`, or `lifecycle`) so the test follows the Chainsaw routing
contract.

In `@operator/internal/cli/utils/utils.go`:
- Around line 393-414: Update the minimum supported operator version constant
used by CheckNodeStateOperatorVersion: change the value of
MinNodeStateSupportVersion (currently "v0.7.5") to the documented floor
"v0.15.0" so the compatibility check in CheckNodeStateOperatorVersion and any
callers use the new minimum; locate the MinNodeStateSupportVersion constant
definition and update it accordingly, then run unit/integration tests that cover
CompareVersions/IsValidVersion to ensure no regressions.

---

Outside diff comments:
In `@docs/cli.md`:
- Line 13: The documentation currently states incompatible minimum operator
versions; update the CLI docs to reflect that the commands "reset --package" and
"update-state" (and the version matrix and minimum-version note) require
operator version v0.15.0 or later instead of v0.7.5+, and adjust all related
lines (including the version note and the matrix entries around the earlier
mentions) so they consistently say v0.15.0+ to prevent guidance for older
clusters.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@k8s-tests/chainsaw/cli/update-state/chainsaw-test.yaml`:
- Around line 22-23: The metadata.labels.pool currently uses the unsupported
value "cli"; change metadata.labels.pool to one of the allowed mutation-profile
values (core, interrupt, uninstall, or lifecycle) that matches the test's
cluster-state/runtime mutation behavior (e.g., set pool: core if it's a standard
core mutation test, interrupt for preemptive interrupt scenarios, uninstall for
teardown tests, or lifecycle for stateful lifecycle tests) by updating the
labels: pool entry accordingly in the YAML.