fix: verify chart access and surface repository readiness

[thbertoldi]

Problem

A successful registry login can coexist with denied chart access or a disconnected Rancher ClusterRepo. Kubeflow, LiteLLM and Qdrant then fail on the first wizard page with configmaps "" not found. NVIDIA repositories can also return a public index while denying a chart download, or return an invalid index that Rancher reports as no API version specified.

Changes

• Settings Test reports three independent results: registry connection, direct sample chart access using the current form, and Rancher's repository readiness using saved settings. Root authentication alone cannot produce a successful overall result.
• Verification uses Rancher's shared labeled inputs, banners and status badges, with the same field width and theme variables as the surrounding Settings controls. Results have labeled rows that stack at narrower widths; error text remains escaped and unsaved-input warnings remain separate from saved repository status.
• The operator reads an OCI chart manifest under the configured repository path. For HTTPS Helm repositories it reads the index and checks a chart download URL with a one-byte range request. Results name the chart/version and distinguish denied access, missing content, invalid metadata, TLS errors and timeouts. SUSE's public chart path receives guidance to check credentials and SUSE AI subscription entitlement; a denial does not assert a licensing diagnosis.
• Private endpoints use their configured path, Secret references and CA bundle, with no public chart fallback. Cleared references are explicit rather than silently using saved credentials. Users can select a chart present in a partial mirror. NVIDIA connected checks follow the controller's public/gated repository policy; mirror mode checks only the mirror.
• The Overview shows managed repository failures with Settings and Rancher links. Applications remain visible but cannot be installed when their repository is unavailable. Dynamic discovery preserves the subset of a healthy private mirror. The wizard checks readiness before index access and gives actionable guidance, including if the index disappears during the request.
• Saved configuration, pending reconciliation and changed form inputs remain distinct. Test is read-only; explicit Refresh rechecks ownership and requests Rancher reconciliation with a resourceVersion guard. A refresh request is pending until a later test observes readiness.
• Add release notes explaining the managed repositories, optional NVIDIA team access, verification scope and the matching operator/extension requirement. Resolve the branch's conflicts with main.

A successful test covers only the displayed sample chart/version and Rancher index readiness. It does not verify all charts, full chart downloads, container images or installation prerequisites.

Validation

• Styling revision 78c6e8e0: 267 UI tests (including 21 verification component tests using real Rancher components), lint, typecheck and the production extension build passed locally. UI CI passed on this commit. Chromium checks covered seven result scenarios in light/dark themes, keyboard Test, changed chart inputs, Refresh Pending → Ready, and narrower widths down to 390 px. The complete Settings page used real components, fonts and Rancher styles with fixture API responses; there were no external requests or browser errors. These screenshots are local previews; no environment was redeployed for this styling change.
• Live-tested revision ec14fee7: both GitHub CI workflows passed; 267 UI tests, lint and typecheck passed. Exact-source operator/UI images and Helm charts built successfully. Operator build, envtest and targeted API/credential-check race tests passed during implementation. The following live results refer to that revision.
• Live Rancher 2.13.1 / RKE2 1.34.4 air-gap lab: native Settings CA propagation, private Harbor/Gitea, and blocked management/downstream public egress. Confirmed running image digests against commit-labelled private Harbor artifacts.
• Verified successful SUSE/Qdrant and Application Collection/Ollama samples, invalid credentials, valid login with denied chart access using a scoped Harbor account, missing CA, missing sample chart, and explicit NVIDIA mirror behavior. Test left saved Settings and ClusterRepo specs unchanged.
• Exercised saved 401 failures and a fresh repository with no index ConfigMap: Overview warning, disabled Qdrant with Ollama available, actionable wizard error without an empty ConfigMap request. Restored credentials and verified Refresh Pending → Ready, enabled application, and loaded wizard version.
• CPU Qdrant and Ollama smoke checks passed on management/downstream through private mirrors. Live UI testing also fixed escaped apostrophes and empty SecretSelector references.

[thbertoldi]

[thbertoldi]

[rewenila]

The following scenarios were validated after small fixes:

Settings page

• Tests for the appco and suse-registry repos pass when credentials are correct and the repos are ready
  
  
• Tests for all nvidia repos pass when credentials are correct and the repos are ready (now using a sample chart from the static catalog over the first chart of the repo in alphabetical order, which could be non-NVAIE supported)
  
  
• Tests correctly identify a pending repo
  
• Tests correctly identify auth error for authenticated repos when credentials are incorrect
  

Apps/Overview pages

• The overview page shows a warning banner when not ready repos are present
  
• Apps from not ready repos show up as disabled and a warning is displayed in the Apps page