CLI: Update hypeman SDK to fea5b3beedd949cd92698ae9f0f1771c5945a0ad and add new commands/flags

[kernel-internal]

This PR updates the Hypeman Go SDK to fea5b3beedd949cd92698ae9f0f1771c5945a0ad and carries the CLI commands/flags added for new SDK methods on this evergreen branch.

SDK Update

• Updated hypeman-go to fea5b3beedd949cd92698ae9f0f1771c5945a0ad (module version v0.28.0)

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands.

• Every method listed in the SDK api.md was enumerated and each now has a corresponding CLI command, or a verified internal call site: client.Health.Check behind hypeman health, client.Instances.Get behind inspect/rm, client.Instances.Stat behind cp, client.Volumes.NewFromArchive behind volume create --from-archive, and client.Builds.Events behind the event stream that hypeman build follows.
• All fields across the SDK param structs, including nested param types such as HealthCheckParam, AutoStandbyPolicyParam, SnapshotCompressionConfigParam, IngressRuleParam, and TagImageRequestParam, were checked against the CLI flag set. The only fields without a dedicated flag remain InstanceNewParamsCredential.Inject and InstanceNewParamsCredentialInject.Hosts, which are reachable through hypeman run --credentials-json since that flag unmarshals the full credential policy map.
• openapi.yaml contains no endpoints marked x-cli-skip: true.

Version v0.28.0 is the release tag for the "local image tagging on shared content storage" change (bfd38ed), which this branch already covers with hypeman image tag. No new methods or param fields came with this bump, so this run is a version bump only and the commands and flags below are the accumulated coverage this branch adds over main.

New Commands

• hypeman image tag <source> <target> for client.Images.Tag(), sending TagImageRequestParam.Target
• hypeman capabilities for client.Capabilities.Get()
• hypeman update expiration for client.Instances.Update() with InstanceUpdateParams.Ttl / ExpiresAt

New Flags

• --graceful-shutdown on hypeman rm for InstanceDeleteParams.GracefulShutdown
• --ttl and --expires-at on hypeman run for InstanceNewParams.Ttl and InstanceNewParams.ExpiresAt
• --ttl and --expires-at on hypeman update expiration for InstanceUpdateParams.Ttl and InstanceUpdateParams.ExpiresAt
• --username, --password, and --registry-token on hypeman image create and hypeman pull for ImageNewParams.Credentials (PushCredentialsParam.Username / Password / RegistryToken)

hypeman image tag takes its source and target as positional arguments in the style of docker tag, so TagImageRequestParam.Target needs no flag. The reference check that hypeman push already applied to its destination is now shared between the two commands, since a tag destination has the same requirement of an explicit tag.

Verification

• go build ./..., go vet ./..., and go test ./... all pass against v0.28.0.

Triggered by: kernel/hypeman-go@fea5b3b
Reviewer: @chruffins

---

Note

Low Risk
Mostly new commands and optional flags; instance delete defaults to graceful shutdown, which slightly changes rm behavior versus always hard-deleting.

Overview
Bumps hypeman-go from v0.24.0 to v0.28.0 and wires new SDK surface into the CLI.

Adds hypeman capabilities to call Capabilities.Get and print host/server runtime features, networking, and image platforms (table by default; --format json / --transform runtimes like other commands). README documents the new command.

Image workflow: hypeman image tag <source> <target> tags local content without re-pulling. --username / --password / --registry-token are factored into shared registry credential helpers and attached to image create and pull; push reuses the same flags. Tag/push destinations share validateTaggedImageReference (explicit tag required).

Instances: hypeman run and hypeman update expiration accept mutually exclusive --ttl and --expires-at. hypeman rm adds --graceful-shutdown (default true) via InstanceDeleteParams; compose reconcile passes empty delete params where the API signature changed.

^{Reviewed by Cursor Bugbot for commit c2de6c7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit d650026. Configure here.}

[chruffins]

reviewed after fixing the Bugbot findings; the CLI changes and tests are ready to merge.