cluster: migrate registry from host container to in-cluster deployment

Replace the shared host-side func-registry container with Kubernetes-native
resources deployed inside each Kind cluster:

- Deployment (registry:2 with hostPort 5000 + emptyDir volume)
- ClusterIP Service (port 5000)
- Contour Ingress at registry.localtest.me

Key changes:
- registryAddr is now "registry.localtest.me" (was "localhost:50000")
- containerd mirrors point at http://localhost:5000 via hostPort (was
  http://func-registry:5000 via Docker network DNS)
- Each cluster owns its own registry, destroyed with kind delete cluster
- Delete flow simplified: no shared container teardown, just host trust
  revert on last-cluster removal
- Removed: ensureRegistry, registryStatus, teardownRegistry,
  setupPodmanMacOSForwarding, and all host-container lifecycle code

Author: lkingland

CLAUDE.local.md

@@ -0,0 +1,136 @@
+# Functions — Hugr Agent Instructions
+
+Repository: https://github.com/knative/func
+
+This file is kept in the hugr repo and symlinked into func src workspaces for
+agents.
+
+## Testing
+
+### Quick validation: `make check`
+
+Run `make check` before signaling completion. It runs linting, vet, and
+template checks — fast enough to run on every change.
+
+### Unit tests: `make test`
+
+Run `make test` for unit-level validation. Sufficient for most changes —
+bug fixes, refactors, new functions with test coverage.
+
+### Full E2E suite
+
+The full E2E test suite (`make test-e2e`) runs against a live Kind cluster
+with a local registry, Knative Serving/Eventing, Tekton, and MetalLB. It
+deploys real functions, invokes them, and validates the full lifecycle.
+
+**When to run locally:**
+- Debugging CI failures that don't reproduce with unit tests alone
+- Validating changes to cluster infrastructure (`pkg/cluster/`)
+- Changes to the deploy/build/push pipeline
+- Before pushing complex multi-file changes that touch the runtime path
+
+**When it's unnecessary:**
+- Small, well-tested changes where `make test` passes
+- Documentation, template, or tooling changes
+- The full suite runs in remote CI on every PR — local runs are for
+  replicability and confidence, not gating
+
+**Prerequisites:**
+```
+export FUNC_ENABLE_CLUSTER=1
+export FUNC_E2E_KUBECONFIG=~/.config/func/clusters/func.local/kubeconfig.yaml
+```
+
+Create the cluster first with `func cluster create --tekton` (requires the binary
+built and `FUNC_ENABLE_CLUSTER=1`). The E2E suite takes ~30 minutes.
+
+## Landing flow
+
+Work in your jj workspace (`$SHARD_ROOT/src/`). When ready to land:
+
+1. Clean commits — squash fixups, reword for clarity
+2. Run `make check` (always) and `make test` (minimum)
+3. DM your requester for review, including test results
+4. After approval, push and open a PR:
+   ```
+   jj git push -c @-    # or whichever commit; creates a remote tracking branch
+   ```
+   Then open a PR against upstream with a clear explanation of the change.
+5. PR must pass CI (unit tests, integration tests, linting)
+
+## Conventions
+
+- Follow upstream Go conventions (gofmt, govet, golint)
+- Tests are required for new functionality
+- Commit messages follow Conventional Commits format
+- Keep PRs focused — one logical change per PR
+
+## Managing multiple changes
+
+### Independent changes (simultaneous PRs)
+
+Base each change on upstream's `main` so it can be pushed and PR'd
+independently, without waiting on other pending work. This avoids stalling
+when one PR is slow to merge.
+
+```
+jj new main          # start Feature A from main
+# ... work ...
+jj git push -c @-    # push Feature A, open PR
+
+jj new main          # start Bugfix A from main (not from Feature A)
+# ... work ...
+jj git push -c @-    # push Bugfix A, open separate PR
+
+jj new main          # start Feature C from main
+# ... work ...
+```
+
+Each change gets its own bookmark (auto-created by `jj git push`) and its
+own PR. They can land in any order.
+
+### Dependent changes (sequential PRs)
+
+When a change depends on another that already has an open PR, make it a
+descendant of the prerequisite change. Do **not** push or open a PR until
+the prerequisite has been merged into `main`.
+
+```
+jj new main          # Feature A: independent, can PR now
+# ... work ...
+jj git push -c @-    # push Feature A
+
+jj new <feature-a>   # Feature B: depends on A, descends from it
+# ... work ...
+# wait for Feature A to land before pushing Feature B
+```
+
+A change may depend on multiple prerequisites — create it with multiple
+parents to reflect that. It should not be pushed until all prerequisites
+appear in `main`.
+
+### Syncing after upstream merges
+
+When a PR has been merged upstream (or when a rebase is required for it to
+land):
+
+```
+jj git fetch --remote upstream
+jj rebase -d upstream/main       # rebase working changes onto updated main
+```
+
+Upstream uses merge commits, so your merged changes will appear as a new
+commit ID on `main`. Your local copies will show as "empty" (their diff is
+now included in the merge commit). At that point, those empty changes can
+be safely abandoned with `jj abandon`.
+
+**Workspace hygiene:**
+- Only perform these operations in your own workspace
+- Only abandon changes that you authored — never touch other agents' work
+- Track change IDs and their push bookmarks on the associated issue for
+  quick lookup
+
+## Branch strategy
+
+- Branches are auto-created by `jj git push` — no manual branch management
+- PRs target `main` unless otherwise specified

cmd/ci/workflow.go

@@ -84,7 +84,14 @@ func createRuntimeTestStep(conf CIConfig, messageWriter io.Writer, steps []step)
 	case "node", "typescript":
 		testStep.withRun("npm ci && npm test")
 	case "python":
-		testStep.withRun("pip install . && python -m pytest")
+		// Create the venv outside the project tree: PEP 668
+		// (externally-managed) blocks pip against the system Python on
+		// modern distros, so a venv is needed; but a venv inside the
+		// project would seed it with absolute symlinks (the venv's
+		// pip3 -> /usr/bin/python3.x etc.) which func deploy rejects
+		// with "project may not contain absolute links". $RUNNER_TEMP
+		// is set by both GitHub Actions and nektos/act.
+		testStep.withRun(`python -m venv "$RUNNER_TEMP/venv" && "$RUNNER_TEMP/venv/bin/pip" install . && "$RUNNER_TEMP/venv/bin/python" -m pytest`)
 	case "quarkus":
 		testStep.withRun("./mvnw test")
 	default:

cmd/config_ci_test.go

@@ -575,7 +575,7 @@ func TestNewConfigCICmd_TestStepPerRuntime(t *testing.T) {
 		{
 			name:        "python runtime adds python -m pytest step",
 			runtime:     "python",
-			expectedRun: "pip install . && python -m pytest",
+			expectedRun: `python -m venv "$RUNNER_TEMP/venv" && "$RUNNER_TEMP/venv/bin/pip" install . && "$RUNNER_TEMP/venv/bin/python" -m pytest`,
 		},
 		{
 			name:        "quarkus runtime adds mvnw test step",

pkg/cluster/delete.go

@@ -8,37 +8,29 @@ import (
 	"path/filepath"
 )
 
-// Delete removes a single func-managed dev cluster. The shared registry
-// container and the host's insecure-registries entry are removed only when
-// the *last* func-managed cluster is being torn down — other surviving
-// clusters keep using the shared registry.
+// Delete removes a func-managed dev cluster. The in-cluster registry is
+// destroyed automatically with the Kind cluster. Host-side trust config
+// (insecure-registries) is only reverted when this is the last func cluster,
+// since other surviving clusters share the same host entry.
 func Delete(ctx context.Context, cfg ClusterConfig, out io.Writer) error {
-	// Set KUBECONFIG for child processes; restore the caller's value on return.
 	defer setKubeconfig(cfg.Kubeconfig())()
 
-	status(out, "Deleting Cluster")
-
-	if err := run(ctx, out, "",
-		cfg.kind(), "delete", "cluster",
-		"--name="+cfg.Name,
-		"--kubeconfig="+cfg.Kubeconfig()); err != nil {
-		warnf(out, "failed to delete cluster %q: %v", cfg.Name, err)
+	if _, err := os.Stat(cfg.Kubeconfig()); err == nil {
+		status(out, "Deleting Cluster")
+		if err := run(ctx, out, "",
+			cfg.kind(), "delete", "cluster",
+			"--name="+cfg.Name,
+			"--kubeconfig="+cfg.Kubeconfig()); err != nil {
+			warnf(out, "failed to delete cluster %q: %v", cfg.Name, err)
+		}
+		_ = os.RemoveAll(filepath.Dir(cfg.Kubeconfig()))
 	}
 
-	// Remove this cluster's kubeconfig dir so the "last cluster?" check
-	// below reflects the post-delete state.
-	_ = os.RemoveAll(filepath.Dir(cfg.Kubeconfig()))
-
-	remaining := List()
-	if len(remaining) == 0 {
-		status(out, "Last func cluster removed; tearing down shared registry")
-		teardownRegistry(ctx, cfg, out)
-		if !cfg.SkipRegistryConfig {
-			revertHostRegistry(out)
-		}
-	} else {
-		fmt.Fprintf(out, "Registry left running; shared with %d other func-managed cluster(s): %v\n",
-			len(remaining), remaining)
+	if remaining := List(); len(remaining) > 0 {
+		fmt.Fprintf(out, "Other func-managed cluster(s) still running: %v; leaving host registry config in place.\n",
+			remaining)
+	} else if !cfg.SkipRegistryConfig {
+		revertHostRegistry(out)
 	}
 
 	fmt.Fprintf(out, "%s  Downloaded container images are not automatically removed.\n", red("NOTE:"))

pkg/cluster/kubernetes.go

@@ -16,7 +16,7 @@ const kindConfigTemplate = `kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: kindest/node:%[1]s
+    image: kindest/node:%s
     extraPortMappings:
     - containerPort: 80
       hostPort: 80
@@ -29,14 +29,14 @@ nodes:
       listenAddress: "127.0.0.1"
 containerdConfigPatches:
 - |-
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."localhost:%[2]d"]
-    endpoint = ["http://%[3]s:%[4]d"]
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.default.svc.cluster.local:%[4]d"]
-    endpoint = ["http://%[3]s:%[4]d"]
+  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.localtest.me"]
+    endpoint = ["http://localhost:5000"]
+  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.default.svc.cluster.local:5000"]
+    endpoint = ["http://localhost:5000"]
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors."ghcr.io"]
-    endpoint = ["http://%[3]s:%[4]d"]
+    endpoint = ["http://localhost:5000"]
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors."quay.io"]
-    endpoint = ["http://%[3]s:%[4]d"]
+    endpoint = ["http://localhost:5000"]
 `
 
 const metalLBPoolTemplate = `apiVersion: metallb.io/v1beta1
@@ -59,8 +59,7 @@ func installKubernetes(ctx context.Context, cfg ClusterConfig, out io.Writer) er
 	start := time.Now()
 	status(out, "Allocating")
 
-	kindConfig := fmt.Sprintf(kindConfigTemplate,
-		kindNodeVersion, registryHostPort, registryContainerName, registryContainerPort)
+	kindConfig := fmt.Sprintf(kindConfigTemplate, kindNodeVersion)
 
 	err := run(ctx, out, kindConfig,
 		cfg.kind(), "create", "cluster",