[TCL-7759] fix: restrict Slurm health checks to idle nodes

[jhu-svg]

Summary

• make the Slinky system default HealthCheckNodeState=IDLE, matching TCCO's current effective policy
• add regression coverage that rejects the unsafe ANY default
• make full-repository lint non-mutating and enforce it in pull-request CI
• publish the change under the unused immutable operator tag 1.0.15

This is stage 1 of TCL-7759. Keep the ticket open and do not remove TCCO's duplicate health-check directives until 1.0.15 is released and adopted by every cleanup target.

Follow-up stack

• adoption: together-cloud-cluster-operator#881
• cleanup: together-cloud-cluster-operator#882, intentionally draft and rollout-blocked

Linear

https://linear.app/together-ai/issue/TCL-7759/fix-duplicate-slurm-config-entries

Test plan

• GOTOOLCHAIN=go1.25.3 make helm-validate test golangci-lint
• git diff origin/slurm-1.0-together-changes...HEAD | gitleaks stdin --redact --no-banner
• Codex review: no actionable findings

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.