[CMGS]

Whole-repo review round (style, simplify, comment budget, hot path, modern Go, docs sync, dependencies, loc-justify). Every tracked file was read in full; no bug reachable from a real caller was found. The exported surface only grows (two additive exports); nothing is unexported or removed. The one contract change is the VM name format (see meta: below).

Commits

• deps: k8s.io/{api,apimachinery,client-go} v0.36.3 -> v0.37.0 in lock-step, controller-runtime v0.24.1 -> v0.25.1, controller-tools v0.20.1 -> v0.22.0 (the regenerated CRDs change only the version annotation), go-containerregistry v0.21.7 -> v0.22.1, klauspost/compress v1.19.2 -> v1.20.0, x/sync v0.22.0 -> v0.23.0; go mod tidy via the proxy. projecteru2/core stays at v0.1.3 (only its log package is used). cocoon-operator, cocoon-webhook, cocoon-net and vk-cocoon build and pass their race suites against this HEAD through a scratch replace.
• docs: apis.md — an empty ConnType infers from the VNC port before the OS.
• review: AnnotationVMName's godoc names the pod as the VM name's source (since meta: name VMs vk-<namespace>.<pod> #31 agent names also derive from the pod name).
• simplify: httpx.Run derives the shutdown context in place and stores Shutdown errors directly (-3).
• build: drop the apis/v1 gochecknoinits exclusion; the package has registered through runtime.NewSchemeBuilder with no init() since 937a6a5.
• meta: VM names become vk-<namespace>-<pod>-<hash>, where <hash> is 6 hex digits of sha256(<namespace>/<pod>). cocoon uses the VM name as the guest hostname, and cloud-init and cloudbase-init keep only the part before the first dot, so since meta: name VMs vk-<namespace>.<pod> #31 every cloudimg and Windows guest in a namespace came up as vk-<namespace>. Dots in the pod name (a CocoonSet name may carry them, e.g. demo.v1) become dashes; the hash covers the original name, so demo.v1-0 and demo-v1-0 stay distinct (pinned by a test that fails if the hash is taken after the replacement). The hash keeps the dash-joined name unique (team-a/dev-0 and team/a-dev-0 differ) and recomputable, which the operator needs to find the main agent's snapshots after its pod is gone. team-a/dev-0 and team/a-dev-0 stay pinned as distinct by a regression test. ExtractAgentSlot accepts a name only when VMNameForDeployment reproduces it, so no toolbox of this or a longer-named set reads as an agent slot (both cases pinned by tests that fail without the check). Cost: one sha256 of under 64 bytes per name build, off every hot path. The engine stays unaware of the control plane: cocoon itself is unchanged. The webhook's 46-character budget now covers vk- + namespace + pod + the 7-character hash, i.e. namespace + pod at most 35. Cutover: meta: name VMs vk-<namespace>.<pod> #31 was never released, so this changes names relative to the released vk-<ns>-<pod>; the meta: name VMs vk-<namespace>.<pod> #31 rollout note applies unchanged (a release-hibernated set woken after rollout boots fresh; an in-flight migration of an old-name main stalls).
• meta: export ToolboxPodName(cocoonSet, toolbox) and HibernateImportSuffix. cocoon-operator (toolboxPodName) and cocoon-webhook (cs.Name+"-"+tb.Name) each compose the toolbox pod name; vk-cocoon (import name) and cocoon-webhook (VM name budget) each spell "-hibernate-import". AGENTS.md §4 puts shared contracts here; the three repos switch to these once this PR merges and their pin moves.

Adversarial read of #31 (meta/vmname.go)

Every caller in the four repos agreed with the #31 scheme, and three candidate bugs were [contrived]. The read did surface the dotted guest hostname, which the meta: commit above resolves.

loc-justify (report only, nothing applied)

Every package EARNED; standing rejections (the 7 unexport candidates, the push/pull envelope copy) are unchanged; the n < 0 clause of ExtractAgentSlot went away with the recompute check. Details in the review ledger.

Gates

golangci-lint 0 issues. on linux and darwin; make fmt-check clean; asl -forwarder=false clean on both GOOS, advisory forwarder run empty; go build on both GOOS; go test -race -count=1 ./... clean on darwin and in a golang:1.27 linux/arm64 container; make generate manifests produces no drift. GitHub Actions are at their latest releases.