feat(cli): llmkube foreman slice renders a sliced Workload from a plan

[Defilan]

What

Task 6a of the Sliced Workloads epic (#1033): llmkube foreman slice --plan FILE — the native successor to the experiment's plan_to_workload.py.

It parses a slice plan (the planner's YAML) and renders a Workload whose pipeline is:

• one issue-fix step per disjoint slice (scoped prompt + shared contract, branch foreman/slicer-<issue>/<slice>),
• an integrate step (dependsOn every slice) carrying the slice branches,
• a reconcile step (dependsOn integrate) carrying the pinned shared_identifiers + contract + the slices' files.

--dry-run prints the rendered Workload; otherwise it is created against the cluster.

Why

The slicer's design is "CLI plans + renders, controller executes." This is the render+apply half: it turns a plan artifact into the Workload the controller (and the integrate/reconcile tools) already know how to run, closing the loop from plan to a running sliced Workload.

How

buildSliceWorkload is a pure function so the render is unit-tested directly (pipeline shape, kinds, branch naming, dependsOn wiring, and that the pins ride in the reconcile payload while the branches ride in integrate's). validateSlicePlan rejects a non-disjoint plan (a file owned by two slices), a missing issue/repo, or no slices — the same disjointness invariant the planner and integrate enforce.

Scope

The planner invocation (fetch the issue + build a repomap + call the model to produce the plan) is Task 6b, a follow-up. This PR consumes a plan file.

Testing

go test ./pkg/cli/ -run 'TestBuildSliceWorkload|TestValidateSlicePlan|TestRunSlice' — pipeline-shape, disjoint-validation, and dry-run-render tests pass. Verified end to end via the real CLI (go run ./cmd/cli foreman slice --plan ... --dry-run renders a valid Workload). Build + golangci-lint (both arches) clean.

Checklist

• Pure render function unit-tested
• Disjoint-plan validation
• go test / golangci-lint / build clean
• DCO sign-off

Part of #1033

---

Assisted-by: Claude Code (Opus 4.8); reviewed and verified by the author.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 26 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/cli/slice.go	83.22%	17 Missing and 9 partials ⚠️

📢 Thoughts on this report? Let us know!