docs: log EC3 upgrade friction — web UI broken, headless needs symlink

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: aa-replicated

FRICTION.md

@@ -118,6 +118,7 @@
 3.  preflights on a fresh VM fail fast.  It seems there's easily scripted fixes we could provide to streamline the onboarding
 4.  Host preflights run during in-place upgrades and fail on ports already in use by the running cluster (e.g. etcd on 2379/TCP). These checks should be skipped for upgrades since the cluster is already installed — flagging in-use ports as blockers on an existing node is incorrect behavior and blocks the upgrade flow in the web UI.
 5.  In-place upgrade via the web UI fails because EC3 attempts to reinstall k0s rather than upgrade the existing cluster. The UI shows "installation" state during what should be an upgrade flow, then errors on k0s already being present. Upgrade appears to not be supported or is broken in this EC3 alpha version.
-6.  **`ReplicatedImageRegistry` docs don't distinguish behavior by image origin** — The docs show using `ReplicatedImageRegistry (HelmValue ".replicated.image.registry")` to handle the replicated SDK image for airgap. This implies the function works uniformly for all images regardless of origin. In practice, calling `ReplicatedImageRegistry` on `proxy.replicated.com` (the SDK's native registry) in beta.1 does not work: without `noProxy=true` it produces a doubled proxy URL (`proxy.replicated.com/proxy/gameshelf/proxy.replicated.com/...`); with `noProxy=true` it returns an empty string for online installs, causing the image to resolve to `docker.io/library/replicated-sdk-image` (wrong). The SDK chart already uses `proxy.replicated.com` natively and works without any `helmchart.yaml` override — EC3 handles routing for it automatically. The docs don't make clear that the replicated SDK image is a special case that should be left alone. Resolution: removed the `replicated.image.registry` override entirely. ~3 hours of debugging across multiple PRs.
+6.  **In-place upgrade via web UI fails; headless upgrade works** — The EC3 web UI upgrade flow fails (see items 4 and 5). Running `sudo ./gameshelf upgrade` headlessly succeeds. Additionally, the headless upgrade on beta.1 fails with `daemon binary not found: expected /usr/local/bin/assets/gameshelf-service` — the binary exists at `/usr/local/bin/gameshelf-service` but beta.1 expects it in an `assets/` subdirectory. Workaround: `sudo mkdir -p /usr/local/bin/assets && sudo ln -s /usr/local/bin/gameshelf-service /usr/local/bin/assets/gameshelf-service`. Severity: Blocker for web UI upgrade path; headless path requires a manual symlink workaround.
+7.  **`ReplicatedImageRegistry` docs don't distinguish behavior by image origin** — The docs show using `ReplicatedImageRegistry (HelmValue ".replicated.image.registry")` to handle the replicated SDK image for airgap. This implies the function works uniformly for all images regardless of origin. In practice, calling `ReplicatedImageRegistry` on `proxy.replicated.com` (the SDK's native registry) in beta.1 does not work: without `noProxy=true` it produces a doubled proxy URL (`proxy.replicated.com/proxy/gameshelf/proxy.replicated.com/...`); with `noProxy=true` it returns an empty string for online installs, causing the image to resolve to `docker.io/library/replicated-sdk-image` (wrong). The SDK chart already uses `proxy.replicated.com` natively and works without any `helmchart.yaml` override — EC3 handles routing for it automatically. The docs don't make clear that the replicated SDK image is a special case that should be left alone. Resolution: removed the `replicated.image.registry` override entirely. ~3 hours of debugging across multiple PRs.