feat(version): warn when vendored charts drift from the talm binary

talm renders from the project's vendored charts/talm/, never the
binary's built-in charts, so upgrading the binary leaves the library
frozen at the version that last ran init — drift that was previously
invisible. On every config-loading command a release build now compares
the two and, by default, prints a non-fatal warning to stderr pointing
at `talm init --update`; stdout and the exit code are unchanged.

A project (strictCharts: true in Chart.yaml) or an operator
(--strict-charts) can promote the warning to a hard error raised before
the command body runs. The check is a no-op for dev/source builds, whose
embedded charts are a moving target the developer controls, and a
best-effort I/O failure never blocks a command.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

main.go

@@ -51,6 +51,14 @@ const cmdNameTalm = "talm"
 //nolint:gochecknoglobals // ldflags-injected build version, idiomatic for go release tooling.
 var Version = "dev"
 
+// strictChartsFlag is bound to the --strict-charts persistent flag. When set
+// (or when Chart.yaml carries strictCharts: true), a content difference
+// between the project's vendored charts/talm/ and the binary's built-in copy
+// becomes a hard error instead of a warning.
+//
+//nolint:gochecknoglobals // cobra persistent flag binds to package-level state, consistent with the rest of this file.
+var strictChartsFlag bool
+
 // skipConfigCommands lists commands that should not load Chart.yaml config.
 // - init: creates the config, so it doesn't exist yet
 // - completion: generates shell completion scripts
@@ -121,6 +129,7 @@ func registerRootFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringVar(&commands.GlobalArgs.Cluster, "cluster", "", "Cluster to connect to if a proxy endpoint is used.")
 	cmd.PersistentFlags().BoolVar(&commands.GlobalArgs.SkipVerify, "skip-verify", false, "skip TLS certificate verification (keeps client authentication)")
 	cmd.PersistentFlags().Bool("version", false, "Print the version number of the application")
+	cmd.PersistentFlags().BoolVar(&strictChartsFlag, "strict-charts", false, "fail if the project's vendored charts/talm/ differs from the talm binary's built-in copy (run `talm init --update` to re-sync)")
 
 	// Shell completion for root persistent flags. --nodes /
 	// --endpoints draw from the in-scope talosconfig contexts.
@@ -185,6 +194,10 @@ func init() {
 			if err != nil {
 				return errors.Wrap(err, "error loading configuration")
 			}
+
+			if err := surfaceChartDrift(); err != nil {
+				return err
+			}
 		}
 
 		// Ensure talosconfig path is set to project root if not explicitly set via flag
@@ -219,6 +232,36 @@ func init() {
 	}
 }
 
+// surfaceChartDrift compares the project's vendored charts/talm/ against the
+// binary's built-in copy and, on a content difference, either fails (strict
+// mode, via Chart.yaml strictCharts or --strict-charts) or warns on stderr.
+// It is a no-op for dev/source builds, whose embedded charts are a moving
+// target the developer controls rather than a released artifact to track.
+func surfaceChartDrift() error {
+	version, ok := strings.CutPrefix(Version, "v")
+	if !ok {
+		return nil
+	}
+
+	drift, msg, err := commands.CheckChartDrift(commands.Config.RootDir, version)
+
+	switch {
+	case err != nil:
+		// Best-effort: a drift-check I/O error must not block the command.
+		fmt.Fprintf(os.Stderr, "WARN: could not check chart drift: %v\n", err)
+	case drift && (commands.Config.StrictCharts || strictChartsFlag):
+		//nolint:wrapcheck // originating error built with errors.New; WithHint adds operator-facing guidance and is the project idiom.
+		return errors.WithHint(
+			errors.New(msg),
+			"run `talm init --update`, or unset strictCharts / drop --strict-charts to downgrade this to a warning",
+		)
+	case drift:
+		fmt.Fprintf(os.Stderr, "WARN: %s\n", msg)
+	}
+
+	return nil
+}
+
 func initConfig() {
 	if len(os.Args) < 2 {
 		return