Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(generator): emit valid KCL from CEL `x-kubernetes-validations`

The translator introduced in #161 produced `check:` blocks that did not
compile under KCL: every `self.X` reference was left intact (KCL `check:`
blocks have no `self` in scope), `has(self.X)` was rendered as the
unsupported `(has self.X)` form, and `cond ? a : b` was emitted as
`a if cond else b` — which KCL's parser rejects inside a schema check
(the `else` token is treated as a bare name there).

Reported downstream by kcl-lang/modules PR #401, where the workaround
was to drop the whole `check:` block on regen. This commit makes the
translation faithful enough to keep the rules:

- Strip `self.` from field accesses (`emitSelect`).
- Map `has(self.X)` to `(X != None)`; `has(m.X)` for non-`self`
  operands is now unsupported because KCL cannot express it.
- Map `size(self)` to unsupported (KCL has no handle on the schema
  instance inside `check:`); `size(self.x)` still becomes `len(x)`.
- Surface CEL ternary inside `check:` as unsupported (the caller drops
  the rule).

The propagated `regex` import for `.matches(...)` rules is also fixed
so the header carries `import regex` and `_regex_match = regex.match`
whenever a CEL check uses `matches()` (previously only triggered by
JSON Schema `pattern`, leaving `check:` blocks referencing an undefined
identifier).

The `TestGenerate_OAI2KCL_K8sValidations` e2e test now also invokes
`kcl` on the generated file (via a new `lookupKCLBinary` helper that
falls back through `$KCL_BIN`, `$PATH`, and the homebrew install path)
so any future regression to invalid KCL fails CI rather than passing
on string-substring matches alone.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>