Diagnose connection failures

Where: an unreachable Fleet card → diagnose, or the no-config onboarding action. Inspection is local and does not execute credential tools; retry connection performs the real probe and may invoke configured credentials.

Use the reported category: repair a missing/invalid source; install or expose the named credential executable; refresh provider login for authentication; request only the specific denied read for RBAC; correct trust/server configuration for TLS; or check VPN, DNS, proxy, and endpoint reachability for network errors. Then retry.

Lumen inspects the ordered kubeconfig sources and reports which source owns a context after merging. Duplicate context names follow source precedence, so repair the owning file shown by diagnostics. Inspection reports source and helper availability without running credential tools. Lumen never recommends disabling TLS or requesting cluster-admin.

Source: src/components/ConnectionDiagnosticsDialog.tsx, src/lib/connectionDiagnostics.ts, src-tauri/src/commands/connection.rs, src-tauri/src/k8s/kubeconfig.rs at v0.18.0.