fix(claude): pin dev-container skills to the minikube context

Address review comments on PR #2741:
- Name the kube context explicitly in every cluster command
  (kubectl --context minikube, helm --kube-context minikube) and warn in
  `status` when the active context is not minikube, so a stray
  `kubectl config use-context` cannot redirect a deploy at a real cluster.
- Route the chart-level `helm upgrade` through $DEVC like every other
  deploy command instead of leaving it to run on the host.
- Run the protoc-header spot-check through $DEVC: in codespace mode a bare
  grep reads the host clone and can falsely validate a stale file.
- Refuse to guess between multiple available Bucketeer codespaces; exit 2
  with the list and honour an explicit BUCKETEER_CODESPACE override.

Author: Hien Vu

.claude/skills/devcontainer-deploy/SKILL.md

@@ -58,25 +58,32 @@ For a code change to one service (e.g. backend):
 
 ```bash
 $DEVC 'make build-go-embed && TAG=localenv make build-docker-images && TAG=localenv make minikube-load-images'
-$DEVC 'kubectl rollout restart deployment <name> && kubectl rollout status deployment <name>'
+$DEVC 'kubectl --context minikube rollout restart deployment <name> && kubectl --context minikube rollout status deployment <name>'
 ```
 
 The Bucketeer deployments are `api`, `web`, `batch-server`, and `subscriber`
-(confirm with `$DEVC 'kubectl get deployments'`). Chart-level
-changes instead: `helm upgrade bucketeer manifests/bucketeer/ --values
-manifests/bucketeer/values.dev.yaml`.
+(confirm with `$DEVC 'kubectl --context minikube get deployments'`). Chart-level
+changes instead:
+
+```bash
+$DEVC 'helm upgrade bucketeer manifests/bucketeer/ --kube-context minikube --values manifests/bucketeer/values.dev.yaml'
+```
+
+Always go through `$DEVC` and always name the context: a bare `helm`/`kubectl`
+runs against whatever context is currently active, which on the host is often a
+real cluster. `$DEVC status` warns when the active context is not `minikube`.
 
 ## 4. Verify
 
 ```bash
-$DEVC 'kubectl get pods'   # everything Running/Completed, restarts not climbing
+$DEVC 'kubectl --context minikube get pods'   # everything Running/Completed, restarts not climbing
 $DEVC 'curl -sk https://api-gateway.bucketeer.io/health'   # must run INSIDE the container
 ```
 
 The `*.bucketeer.io` hosts entries live in the container's `/etc/hosts`
 (pointed at `minikube ip`) — curl from the host proves nothing. For a failing
-pod: `$DEVC 'kubectl logs deploy/<name> --tail=100'` and
-`$DEVC 'kubectl describe pod <pod>'`.
+pod: `$DEVC 'kubectl --context minikube logs deploy/<name> --tail=100'` and
+`$DEVC 'kubectl --context minikube describe pod <pod>'`.
 
 ## Related dev-cluster chores
 

.claude/skills/devcontainer-generate/SKILL.md

@@ -52,7 +52,9 @@ error; don't force it without flagging the compatibility break to the user.
   outputs. **A diff touching every `.pb.go` in the repo means a wrong protoc
   version — abort and check `$DEVC 'protoc --version'`.**
 - Spot-check one regenerated file's header still says `protoc v4.23.4`:
-  `grep -m1 "protoc " proto/<domain>/<file>.pb.go`
+  `$DEVC 'grep -m1 "protoc " proto/<domain>/<file>.pb.go'` — run it through
+  `$DEVC`, not bare: in codespace mode the host clone is a *different* checkout,
+  so a bare `grep` would validate a stale file that was never regenerated.
 - Build still compiles: `$DEVC 'make build-go'` (or the affected
   `make build-<service>`), and `$DEVC 'make gofmt'` after any Go changes.
 

.claude/skills/devcontainer-run/SKILL.md

@@ -42,7 +42,12 @@ Detection order (the script handles all of this):
 2. Local devcontainer → `docker ps` filtered by label `devcontainer.local_folder=<repo root>`, exec via `docker exec`.
 3. GitHub Codespace → `gh codespace list` (needs the `codespace` auth scope), exec via `gh codespace ssh`.
 
-Exit code 2 means no container was found; the script prints how to start one.
+If more than one available Bucketeer codespace matches (a fork is also named
+`bucketeer`, or you keep several), the script refuses to guess and exits 2 with
+the list — pick one with `export BUCKETEER_CODESPACE=<name>`.
+
+Exit code 2 means no container was found (or the codespace was ambiguous); the
+script prints how to start one.
 Don't fall back to running the command on the host in that case — tell the user
 and let them choose, because host tool versions (especially protoc) may differ.
 

.claude/skills/devcontainer-run/scripts/exec.sh

@@ -35,11 +35,36 @@ detect() {
     return
   fi
 
-  # Case 3: GitHub Codespace (requires `gh` with the codespace scope)
-  CODESPACE="$(gh codespace list --json name,repository,state \
+  # Case 3: GitHub Codespace (requires `gh` with the codespace scope).
+  # Never silently pick one: a fork named `bucketeer`, or several codespaces on
+  # this repo, would otherwise run commands in the wrong clone/branch/cluster.
+  local candidates
+  candidates="$(gh codespace list --json name,repository,state \
     -q '.[] | select((.repository | endswith("/bucketeer")) and .state == "Available") | .name' 2>/dev/null \
-    | head -1 || true)"
-  if [ -n "$CODESPACE" ]; then
+    || true)"
+  if [ -n "${BUCKETEER_CODESPACE:-}" ]; then
+    if ! echo "$candidates" | grep -qx -- "$BUCKETEER_CODESPACE"; then
+      echo "BUCKETEER_CODESPACE='$BUCKETEER_CODESPACE' is not an available Bucketeer codespace." >&2
+      echo "Available:" >&2
+      echo "$candidates" | sed 's/^/  - /' >&2
+      exit 2
+    fi
+    CODESPACE="$BUCKETEER_CODESPACE"
+    MODE=codespace
+    return
+  fi
+  local count
+  count="$(echo "$candidates" | grep -c . || true)"
+  if [ "$count" -gt 1 ]; then
+    echo "Multiple available Bucketeer codespaces found — refusing to guess:" >&2
+    echo "$candidates" | sed 's/^/  - /' >&2
+    echo "" >&2
+    echo "Pick one explicitly:" >&2
+    echo "  export BUCKETEER_CODESPACE=<name>" >&2
+    exit 2
+  fi
+  if [ "$count" -eq 1 ]; then
+    CODESPACE="$candidates"
     MODE=codespace
     return
   fi
@@ -93,15 +118,20 @@ status_report() {
     command -v mockgen >/dev/null && echo "go-tools: OK" || echo "go-tools: MISSING (run bash .devcontainer/setup.sh)"
     docker info >/dev/null 2>&1 && echo "dockerd: running" || echo "dockerd: NOT running (start with: nohup sudo dockerd > /tmp/dockerd.log 2>&1 &)"
     if minikube status >/dev/null 2>&1; then
+      # Always query the minikube context explicitly: the active context may point
+      # somewhere else entirely (a real GKE cluster), and reporting its pods here
+      # would be exactly the confusion this wrapper exists to prevent.
+      ctx=$(kubectl config current-context 2>/dev/null || echo unknown)
+      [ "$ctx" != "minikube" ] && echo "kube-context: WARNING active context is \"$ctx\", not minikube — bare kubectl/helm commands would hit that cluster; pass --context minikube / --kube-context minikube"
       # Ignore transient states (Pending/ContainerCreating/Init) — batch CronJobs
       # constantly spawn short-lived pods and would make the count flap.
-      if pods=$(kubectl get pods --no-headers 2>/dev/null); then
+      if pods=$(kubectl --context minikube get pods --no-headers 2>/dev/null); then
         total=$(echo "$pods" | grep -c . || true)
         failing=$(echo "$pods" | grep -cE "CrashLoopBackOff|ImagePull|ErrImage|Error|OOMKilled|Evicted" || true)
         echo "minikube: running ($total pods, $failing failing)"
         [ "$failing" -gt 0 ] && echo "$pods" | grep -E "CrashLoopBackOff|ImagePull|ErrImage|Error|OOMKilled|Evicted"
       else
-        echo "minikube: running, but kubectl failed to list pods — check kubectl config (kubectl config current-context)"
+        echo "minikube: running, but kubectl failed to list pods in the minikube context — check kubectl config (kubectl config get-contexts)"
       fi
     else
       echo "minikube: NOT running (start with: make start-minikube — never minikube start)"