chore(systemtest): keep UpCloud lanes out of the default set

[Myothas]

Summary

UpCloud costs too much to use for routine lifecycle testing. This removes the upcloud (Ankra-managed) and uks (cloud-managed) lanes from the default provider lists in:

• systemtest/lifecycle_systemtest.sh
• the systemtest.yml schedule and dispatch defaults
• systemtest/README.md

Both lanes still run when a caller names them, for example a dispatch with providers: upcloud or managed_providers: uks.

Context: the 10-14 investigation of "could not resolve cluster id" (ankra-ews9qk, #510/#511) found the UpCloud test account out of credits. The decision is to stop testing on UpCloud routinely rather than top the account up.

Tests

• TestLanePlan now checks that a configured UpCloud credential doesn't pull either lane back into the default set (8 lanes requested, the output never mentions upcloud or uks).
• A new case checks that naming upcloud and uks still runs them.
• The pre-commit gate passed: go test ./... and golangci-lint (0 issues).

Bead: ankra-umo466

🤖 Generated with Claude Code

[ankra-platform]

Ankra AI review

Verdict: looks good.

The change consistently removes upcloud/uks from the default lane sets across the workflow dispatch defaults, the scheduled-run env fallbacks, the shell script defaults, and the docs, and the test updates correctly reflect the new 8-lane default with an opt-in regression test. The arithmetic in the updated expectations (8 requested, 7 skipped, 1 runnable) checks out. CI is still running, so build status is unknown, but nothing in the diff itself looks broken.

Findings

• [low] Substring rejection patterns may be brittle (systemtest/lifecycle_systemtest_test.go:140)
  rejectOutput entries "upcloud" and "uks" are short substrings; if the plan output ever prints, say, a secret name like SYSTEMTEST_UPCLOUD_CREDENTIAL_ID or a lane table mentioning the opt-in lanes even when not requested, this test would fail spuriously. I can't see how rejectOutput is matched (substring vs line) or the full expected summary table, so this may be fine, but consider matching whole lane tokens if the harness allows it.

---

Reviewed commit 14e9a45. This review is read-only and advisory.

[ankra-platform]

[low] Substring rejection patterns may be brittle

rejectOutput entries "upcloud" and "uks" are short substrings; if the plan output ever prints, say, a secret name like SYSTEMTEST_UPCLOUD_CREDENTIAL_ID or a lane table mentioning the opt-in lanes even when not requested, this test would fail spuriously. I can't see how rejectOutput is matched (substring vs line) or the full expected summary table, so this may be fine, but consider matching whole lane tokens if the harness allows it.

_{Ankra AI review. Read-only and advisory.}

[Myothas]

On the low finding: the broad match is deliberate. In that case neither UpCloud lane is requested, so the plan output has no reason to mention upcloud or uks at all. Any mention, even SYSTEMTEST_UPCLOUD_CREDENTIAL_ID in a skip line, would mean a lane had crept back into the default, which is exactly the regression this case guards.