Feat/persysctl api route+sdk fmt

[miladhzzzz]

Summary

Companion to the persys-gateway routing refactor (see gateway PR link).
That PR changed the gateway to support cluster-scoped routes
(/clusters/{cluster_id}/...) while also keeping the original flat
routes (/workloads/..., /nodes/..., etc.) working for backward
compatibility. This PR makes which shape persysctl targets
configurable, and separately fixes a real bug in TaintNode that the
gateway refactor surfaced.

New: api_version config

• config.APIVersion: "v1" (default/unset) or "v2".
  • v1 — flat paths (/workloads/schedule, /nodes/{id}/drain,
    /cluster/metrics, /forgery/builds/trigger, ...), resolving to
    the gateway's default cluster server-side. This is the original
    route shape every persys-gateway has always served — existing
    configs need zero changes, since unset behaves identically to
    before this PR.
  • v2 — cluster-scoped paths
    (/clusters/{cluster_id}/workloads/schedule, ...), using the new
    config.ClusterID field. Fails fast with a clear error if
    api_version is "v2" but cluster_id isn't set, rather than
    silently hitting the wrong (or no) cluster.
• New clusterPath(suffix string) (string, error) helper on Client,
  used by every workload/node/cluster-metrics/forgery HTTP call site.
  Not used for /clusters (lists all clusters, inherently
  cluster-agnostic), /automation/*, or /ai/* — none of those gained
  cluster-scoped variants on the gateway side, in either version.

Note: internal/config.Config needs APIVersion string and
ClusterID string fields added — see
config_additions.go.txt in the patch for the exact struct fields and
suggested CLI flag wiring (--api-version, --cluster-id). I don't
have visibility into the actual internal/config file in this repo, so
that part is a diff to apply by hand rather than a generated patch.

Bug fix: TaintNode request shape

Independent of API versioning — TaintNodeRequest.Taint is a nested
proto message ({key, value, effect}), unlike every sibling
node-management request (Drain, Undrain, SetNodeLabel, etc.),
which have those fields flat at the top level. taintNodeHTTP was
sending a flat body ({"key":...,"value":...,"effect":...}), which
never matched the real request shape. Fixed to send
{"taint": {"key":...,"value":...,"effect":...}}.

This was likely masked before by the gateway's old hand-written
TaintNodeHandler, which probably did its own field-by-field
translation regardless of body shape; the gateway's new generic
reflection-based dispatch decodes the body directly against the real
proto, so the mismatch is no longer silently absorbed on that end.

Testing

• Verified clusterPath end-to-end for both v1 (unchanged behavior,
  confirmed against a live gateway) and v2 (confirmed cluster-scoped
  paths resolve and the missing-cluster_id fail-fast fires correctly).
• TaintNode verified against the corrected gateway
  (PathParams-aware grpcbridge) — this fix depends on that gateway
  change; deploy together, or TaintNode will continue to fail against
  an un-patched gateway.

Breaking changes

None for existing configs/usage — api_version unset behaves exactly
as before. TaintNode callers get a request that actually reaches the
scheduler correctly, which in practice means "was broken, now works,"
not a behavior change existing code depended on.

Depends on

persys-gateway: dynamic routing + grpcbridge PathParams fix (see
companion PR). Both should land together — this client's v1 flat paths
rely on the gateway's dual v1/v2 mount, and TaintNode relies on the
gateway's path-param injection fix.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.