feat(cluster): --network-mode ipv4_nat|ipv6_only on ankracloud create and preflight (ankra-t9c7w.334.1)

[CodeStaple]

Summary

• ankra cluster ankracloud create and ankra cluster ankracloud preflight take --network-mode ipv4_nat|ipv6_only, sent as network_mode in the JSON body the cluster API already accepts. Empty leaves the member out of the body so the server default (ipv4_nat) applies.
• The value is validated client-side (case- and whitespace-insensitive); anything outside the two modes exits 2 with invalid --network-mode "<value>": must be one of ipv4_nat, ipv6_only (omit it for the server default) before any request goes out.
• The create help text explains the two layouts, the flag help names the server default, and the embedded ankra-cloud-clusters skill (SKILL.md and reference.md) documents the preflight-then-create flow for a zone with no public IPv4.
• CHANGELOG Unreleased entry.

Why: a zone with no public IPv4 left for the bastion was a dead end from the CLI. The platform preflight answers create the cluster with network_mode ipv6_only, and ankra v0.33.1 had no flag to pass it.

Tests

• cmd/ankracloud_cluster_test.go: the flag reaches both the create and the preflight request (including IPv4_NAT with whitespace, normalised), the default request carries no network mode, and an unknown value is refused on both verbs with no request sent.
• internal/client/ankracloud_clusters_test.go: the body carries network_mode when set and omits it when empty.
• go build ./..., go vet ./..., golangci-lint run ./... (0 issues), go test -race -count=1 ./....

The ankra-docs CLI reference is generated on release; not edited here.

Bead: ankra-t9c7w.334.1

🤖 Generated with Claude Code

[ankra-platform]

Ankra AI review

Verdict: looks good.

The change threads --network-mode through the shared create/preflight request builder with client-side validation, normalization, and omitempty serialization so the server default still applies when the flag is omitted. Tests cover pass-through on both verbs, normalization of case/whitespace, refusal of unknown values before any request is sent, and omission of the field from the JSON body. Docs, changelog, and skill references are consistent with the implementation. No correctness or security issues found.

---

Reviewed commit 3657d26. This review is read-only and advisory.