Add gated Knative substrate preflight

tools/knative-preflight.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Read-only substrate probe. It never reads Secret resources.
+context="$(kubectl config current-context)"
+kubectl auth can-i get nodes >/dev/null
+server_version="$(kubectl version -o json | jq -r '.serverVersion.gitVersion')"
+node_count="$(kubectl get nodes -o json | jq '.items | length')"
+ready_nodes="$(kubectl get nodes -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "Ready" and .status == "True"))] | length')"
+knative_crds="$(kubectl get crd -o name | grep -c 'knative.dev' || true)"
+ingress_classes="$(kubectl get ingressclass -o json | jq '[.items[].metadata.name]')"
+storage_classes="$(kubectl get storageclass -o json | jq '[.items[].metadata.name]')"
+
+jq -n \
+  --arg context "$context" \
+  --arg server_version "$server_version" \
+  --argjson node_count "$node_count" \
+  --argjson ready_nodes "$ready_nodes" \
+  --argjson knative_crds "$knative_crds" \
+  --argjson ingress_classes "$ingress_classes" \
+  --argjson storage_classes "$storage_classes" \
+  '{
+    schema_version: "railiance.knative-preflight/v1",
+    collected_at: (now | todateiso8601),
+    collector: "railiance-cluster/tools/knative-preflight.sh",
+    context: $context,
+    kubernetes_server_version: $server_version,
+    nodes: {total: $node_count, ready: $ready_nodes},
+    knative_crd_count: $knative_crds,
+    ingress_classes: $ingress_classes,
+    storage_classes: $storage_classes,
+    secret_values_collected: false
+  }'