fix(edit): bound edit-loop API calls and unify the editor retry loop

Extract a shared $EDITOR retry-loop engine (editor.Loop) used by both the
k8s resource edit and helm values edit; bound every API call on the
tea.Exec-suspended path at 10s so an incorrect edit can never freeze the
TUI. Preserve user edits on parse/API/timeout errors (k8s 409 presents
the re-fetched server version), switch helm values upgrades to
HookOnlyStrategy (no readiness wait) with a request-bounded transport,
and bound OCI chart pulls.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(copy): fix for paste into terminal

refactor(notify): use slices.Reverse instead of hand-rolled reverseCopy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(nav): EndpointSlice-based service drilldown; bump Go 1.26.4 + deps

Replace the legacy core/v1 Endpoints service drilldown with a
discovery.k8s.io/v1 EndpointSlice one: svc → endpointslice → pods plus
endpointslice → svc parent-nav, label-matched via kubernetes.io/service-name.
Add workload.EndpointSlicesGVR and the resolvers FindEndpointSlicesForService
/ FindPodsByEndpointSlice / FindServiceForEndpointSlice; wire DrillDown/DrillUp
into the services and endpointslices plugins; demote the endpoints plugin to a
plain listable resource. Manifest mode now fabricates EndpointSlices instead of
Endpoints. Bump go.mod to 1.26.4 and update all dependencies.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix: clear context badge on close, quiet stdin manifest reload

closeFocusedSplit never re-ran syncPaneFooters, so closing a pane that
dropped the set back to one context left a stale context badge on the
remaining pane. Call syncPaneFooters after SyncRefs on both close paths.

In stdin manifest mode, Ctrl+r emitted a "stdin can't be re-read" toast
and skipped the redraw, reading as a broken feature. Return tea.ClearScreen
silently instead, matching the file-reload path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix contexts keys

feat: manifest mode, secret reveal, describe-pane + startup fixes

Manifest visualization: static 'manifests' pseudo-cluster built from --file/stdin (internal/manifest load/parse/synth), registered as a pinned nil-client cluster surfaced in the contexts view.

Uncover (x): reveal volume-mounted Secrets/ConfigMaps, projected volume sources, and imagePullSecrets (registry+username only, never tokens). Shared containers resolvers exported (IndexByName/ConfigMapData/SecretData) with .data+.binaryData decode.

Fix: x (env resolve) now appears and works in the describe pane — currentContext() carries the focused resource name in detail panes instead of an empty string that filtered For-scoped bindings.

Fix: manifest startup stamps the 'manifests' context badge (offline) instead of leaving 'default', since the pinned cluster has no client.

Fix: --details startup panel populates from the first row via InitDetailRefreshMsg routed through Update — the pinned manifest store fires no async update to fill it otherwise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(ui): copy/open chord, k9s-style cursor health styling

Add a `c` chord for copying or opening whatever the focused pane shows:
  - cc copy-current: marked/cursor resource name(s), detail-panel buffer,
    or buffered log lines
  - cy copy-yaml: selected resource(s)' live YAML (joined by ---),
    regardless of focused pane
  - co open-current: resource YAML / panel buffer in $EDITOR via temp
    file, or save+open+copy-path for logs

Copies hit the native OS clipboard best-effort and always emit OSC52 so
they reach the local clipboard over SSH. New internal/clipboard package
wraps Copy (OSC52 + atotto fallback) and JoinNames/JoinYAML helpers;
atotto/clipboard promoted from indirect to direct dep. Rebind log-pager
container select c→C to free the chord prefix.

Cursor-row health styling: an unready/transitional cursor row in an
active pane is now filled red/yellow with dark text (ui.text_on_status)
instead of the plain accent selection, keeping the k9s signal visible
under the cursor. Drop the unused TableSelectedDimStyle.

Also: route mouse/terminal-pane focus through FocusSplitAt's self-
reconcile instead of a follow-up FocusResources, refresh container
drill-downs on a parent-GVR match, and document the focus invariant in
CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(notify): toast notifications with variable-size rendering

Add the in-app notifications system and its toast overlay:

- internal/notify: bounded, mutex-guarded message store backing both the
  toast overlay and the aku-messages synthetic resource. Add dispatches
  its send callback on its own goroutine so it NEVER blocks the Bubble Tea
  Update loop (the unbuffered-channel deadlock fix).
- internal/plugins/notifications: aku-messages resource plugin.
- internal/ui/toaststack: top-right toast stack. Toasts shrink to fit
  their text up to min(40% cols, 60) wide, word-wrap onto up to
  min(30% rows, 6) lines, and truncate with an ellipsis beyond that;
  caps are terminal-proportional and computed per render. Tiny terminals
  render no toast rather than overflow.
- config: notifications block (buffer size, max_visible, per-level
  timeouts); wiring in cmd/root.go; supporting msgs/statusbar changes.

Includes comprehensive toaststack tests (shrink-to-fit, wrap, hard-break,
height floor/ceiling/exact-boundary, proportional caps, size guards) and
a regression guard that Add never blocks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(terminal): graceful remote shell termination on pane close

Add Terminal.TerminateGracefully: best-effort coax the remote shell to
exit on its own (Ctrl-C then a burst of Ctrl-D to peel nested shells)
before the hard Close(), so pane-close/quit doesn't orphan the shell.
Exposes DefaultGraceTimeout for callers and covers the race with a
concurrent Close().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>