fix(renovate): cap talosctl at the cluster's Talos minor

[axeII]

Follow-up to #3896. Grouping made the client/cluster skew visible — #3834 now pairs talosctl 1.14.0 with a v1.13.10 cluster in one diff — but visibility isn't prevention. This enforces it.

Two layers

1. allowedVersions cap (.renovate/allowedVersions.json5)

{
  description: "Hold talosctl at the cluster's Talos minor (talenv.yaml)",
  matchManagers: ["mise"],
  matchPackageNames: ["/talosctl/", "/siderolabs\\/talos/"],
  allowedVersions: "<1.14",
}

Renovate can no longer propose talosctl ahead of the cluster. A Talos minor upgrade becomes a deliberate step instead of arriving as a client bump.

2. A consistency check, because the cap will rot

The cap is a static string that must be raised whenever talosVersion moves. That's a comment nobody reads on the day it matters — and if it's forgotten, talosctl silently lags the cluster instead, which is the same problem inverted.

So find_mistakes.py now compares the pins directly against the cluster:

mise.toml	must equal	talos/talenv.yaml
talosctl	↔	talosVersion
kubectl	↔	kubernetesVersion

This catches exactly what allowedVersions cannot see: one side bumped without the other, or a stale cap after an upgrade.

Verification

Run against #3834's actual contents:

Scenario	Result
talosctl 1.14.0, cluster v1.13.10 (#3834 today)	❌ exit 1 — "talosctl is 1.14.0 in mise.toml but the cluster is 1.13.10 in talos/talenv.yaml - bump both together"
talosctl 1.13.10, cluster v1.13.10	✅ exit 0
kubectl 1.37.0, k8s v1.37.0	✅ passes — already agree
current main	✅ exit 0, only the 2 documented warnings

just validate, just flate-test (169 passed) and pre-commit all pass.

Severity note

find_mistakes.py isn't referenced by any workflow, .pre-commit-config.yaml, or the justfile — it's invoked manually per AGENTS.md. So the new error is a strong local signal, not a merge blocker. Say the word if you'd rather it were a warning, or wired into CI as a real gate.

Merge order matters

Merge this before #3834. Renovate will then regenerate #3834 with talosctl 1.13.10 on its next run. If #3834 merges first, 1.14.0 lands and Renovate won't downgrade it — you'd be capped at a version you're already past.

I'm also pinning #3834's branch to 1.13.10 directly so the ordering can't bite either way.

Upgrade runbook (for when you do go to v1.14)

1. Raise the cap to "<1.15" here.
2. Let the grouped Renovate PR bump talenv.yaml, both tuppr CRs, and both mise pins together.
3. python3 scripts/find_mistakes.py — exit 0 confirms client and cluster agree before tuppr touches a node.

[bot-akira]

konflate — summary

Note

✅ No rendered changes.

View the full rendered diff →

_{konflate · rendered 53f60b4 · advisory, not a gate}