check-local-context should enforce exact Kind cluster context

[ktdreyer]

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Summary

check-local-context in the Makefile accepts any kubectl context with a kind- prefix. In a multi-worktree setup where each worktree gets its own Kind cluster (via CLUSTER_SLUG), this means kubectl commands can silently operate on the wrong cluster.

Steps to reproduce

1. Create two worktrees with different branches:

   git worktree add ../feature-a feature-a
   git worktree add ../feature-b feature-b
   

2. Bring up a Kind cluster in each:

   cd ../feature-a && make kind-up
   cd ../feature-b && make kind-up
   

3. In feature-b, switch kubectl context to feature-a's cluster:

   kubectl config use-context kind-ambient-feature-a
   

4. Run a target that depends on check-local-context:

   make kind-rebuild
   

Actual results

check-local-context passes because the context starts with kind-. The rebuild operates on feature-a's cluster instead of feature-b's cluster.

Expected results

check-local-context should verify the context matches kind-$(KIND_CLUSTER_NAME) exactly and fail with a message like:

Current kubectl context 'kind-ambient-feature-a' does not match 'kind-ambient-feature-b'.
  Switch context first, e.g.: kubectl config use-context kind-ambient-feature-b

Affected targets

All targets that depend on check-local-context:

• local-test-quick
• kind-rebuild
• kind-port-forward
• dev-bootstrap

Suggested fix

 check-local-context:
 ifneq ($(SKIP_CONTEXT_CHECK),true)
-	@ctx=$$(kubectl config current-context 2>/dev/null || echo ""); \
-	if echo "$$ctx" | grep -qE '^kind-'; then \
+	@expected="kind-$(KIND_CLUSTER_NAME)"; \
+	ctx=$$(kubectl config current-context 2>/dev/null || echo ""); \
+	if [ "$$ctx" = "$$expected" ]; then \
 		: ; \
 	else \
-		echo "Current kubectl context '$$ctx' does not look like a local cluster."; \
-		echo "  Expected a context starting with 'kind-'."; \
-		echo "  Switch context first, e.g.: kubectl config use-context kind-ambient-local"; \
+		echo "Current kubectl context '$$ctx' does not match '$$expected'."; \
+		echo "  Switch context first, e.g.: kubectl config use-context $$expected"; \
 		echo ""; \
 		echo "  To bypass this check: make <target> SKIP_CONTEXT_CHECK=true"; \
 		exit 1; \
 	fi
 endif

Surfaced by CodeRabbit on #900.