fix(cli): --no-cluster must not deploy the snapshot-capture agent

pkg/cli/validate.go

@@ -516,6 +516,16 @@ Run validation without failing on check errors (informational mode):
 
 			var snap *snapshotter.Snapshot
 
+			// --no-cluster means "do not touch the cluster". The agent-deploy
+			// branch below contradicts that (it creates a Job and captures a
+			// snapshot from the live API), so a snapshot file is the only valid
+			// data source in that mode. Placed after recipe.LoadFromFile so
+			// recipe kind-check and auto-hydration still run for CLI coverage.
+			if snapshotFilePath == "" && cmd.Bool("no-cluster") {
+				return errors.New(errors.ErrCodeInvalidRequest,
+					"--no-cluster requires --snapshot (cannot deploy the snapshot-capture agent without cluster access)")
+			}
+
 			if snapshotFilePath != "" {
 				slog.Info("loading snapshot", "uri", snapshotFilePath)
 				snap, err = serializer.FromFileWithKubeconfig[snapshotter.Snapshot](snapshotFilePath, kubeconfig)

pkg/cli/validate_test.go

@@ -273,7 +273,7 @@ func TestValidateCmd_RecipeKindHandling(t *testing.T) {
 			name:        "RecipeMetadata with criteria auto-hydrates",
 			yamlContent: "kind: RecipeMetadata\napiVersion: aicr.nvidia.com/v1alpha1\nmetadata:\n  name: test\nspec:\n  criteria:\n    service: eks\n    accelerator: h100\n    intent: training\n",
 			wantErr:     true,
-			errContain:  "kubernetes client",
+			errContain:  "--no-cluster requires --snapshot",
 			errAbsent:   "has no criteria",
 		},
 		{
@@ -292,14 +292,14 @@ func TestValidateCmd_RecipeKindHandling(t *testing.T) {
 			name:        "RecipeResult kind passes kind check",
 			yamlContent: "kind: RecipeResult\napiVersion: aicr.nvidia.com/v1alpha1\n",
 			wantErr:     true,
-			errContain:  "kubernetes client",
+			errContain:  "--no-cluster requires --snapshot",
 			errAbsent:   "is required",
 		},
 		{
 			name:        "empty kind passes kind check",
 			yamlContent: "apiVersion: aicr.nvidia.com/v1alpha1\n",
 			wantErr:     true,
-			errContain:  "kubernetes client",
+			errContain:  "--no-cluster requires --snapshot",
 			errAbsent:   "is required",
 		},
 	}