fix(deployment): default k3s image and --k3s-image argument in deploy.py

[tombch]

I encountered an issue running ./deploy.py cluster --dev and ./deploy.py helm --dev as-is. When running ./deploy.py helm --dev, I would get:

Error: INSTALLATION FAILED: unable to build kubernetes objects from release manifest: [resource mapping not found for name: "compression-middleware" namespace: "" from "": no matches for kind "Middleware" in version "traefik.containo.us/v1alpha1"
ensure CRDs are installed first, resource mapping not found for name: "redirect-middleware" namespace: "" from "": no matches for kind "Middleware" in version "traefik.containo.us/v1alpha1"
ensure CRDs are installed first, resource mapping not found for name: "redirect-www-middleware" namespace: "" from "": no matches for kind "Middleware" in version "traefik.containo.us/v1alpha1"
ensure CRDs are installed first, resource mapping not found for name: "cors-all-origins" namespace: "" from "": no matches for kind "Middleware" in version "traefik.containo.us/v1alpha1"
...

It turns out this was because the k3d cluster create command does not specify the k3s image, and was installing a version of k3s that uses traefik v3 rather than v2. K3s version 1.32 and above installs traefik v3 by default: https://docs.k3s.io/upgrades#version-specific-caveats .

This PR adds a --k3s-image argument for deploy.py cluster, with the image defaulting to rancher/k3s:v1.31.14-k3s1 which resolves the helm issue. The user can also choose to use a different image if they want to.

I'm not really aware of where this deployment script is used, so I am curious if anyone already encountered this issue (I saw there is an issue open for upgrading traefik: #6014).

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by appropriate, automated tests.
• Any manual testing that has been done is documented (i.e. what exactly was tested?)

🚀 Preview: Add preview label to enable

[claude]

Claude finished @tombch's task in 1m 17s —— View job

---

Code Review

• Gather context
• Review changes
• Post feedback

---

Good fix for a real usability issue. The root cause analysis and default version choice are well-reasoned, and the inline comments explaining why v1.31 is used are helpful.

One bug to address: since --k3s-image always has a default value, the if args.k3s_image: guard on line 195 is always True — it's dead code that makes it look like the image might be omitted. It also changes run_command(command, shell=True) to run_command([command], shell=True) without reason (passing a single-element list to shell=True works but is unusual). See inline comment for a suggested simplification.

Minor: the --k3s-image argument is not documented anywhere (README, docs). Given it's a developer-facing change that affects --dev workflows, a note in the relevant docs would be worth adding.

[anna-parker]

see slack thread: https://loculus.slack.com/archives/C06JCAZLG14/p1773836281787349