fix(storage/kubernetes): fix Client name shadowing regression from #74

[mridulgain]

Summary

Urgent — regression already on master, affects the Kubernetes storage backend.

#74's golangci-lint v2 migration blanket-replaced .ObjectMeta.Name with .Name across storage/kubernetes/storage.go and types.go to resolve staticcheck's QF1008 "embedded field" suggestions. That's safe for most types there, but storage/kubernetes.Client declares its own explicit Name string field (the client's display name, e.g. "dex client"), which shadows the embedded k8sapi.ObjectMeta.Name (the actual Kubernetes resource name, a hash of the client ID).

Go silently resolves c.Name to the shallower, explicit field — no compile error, no ambiguity error — so DeleteClient/UpdateClient started PUTting/DELETEing using the client's display name instead of its resource name. This fails Kubernetes' DNS1123 name validation outright for any display name containing uppercase/spaces/etc. (surfaced as invalid kubernetes resource name: must match the pattern ...), or worse, could silently target the wrong resource if the display name happened to already be a valid k8s name.

This is exactly why staticcheck itself never flagged these two call sites (storage.go:426,496) even though the blanket sed touched them anyway — the quickfix check is shadow-aware and only flags genuinely behavior-preserving simplifications. The regression was introduced by mechanically applying more replacements than the linter actually flagged, instead of only the ones it called out.

Fix

Reverts the two call sites to c.ObjectMeta.Name. Verified this is the only affected type: Connector also declares its own Name field, but its delete/put call sites already used the id parameter directly and were untouched by the sed.

Test plan

• go build ./..., go test ./storage/kubernetes/... pass
• golangci-lint run reports 0 issues — confirms the quickfix check correctly does not re-flag these two lines, validating it's shadow-aware
• Surfaced by CI on fix(UT): pin validator clock in tests to avoid fixture cert expiry #72 (mg/fix-saml-test-cert-expiry), which merged latest master and hit TestStorage/ClientCRUD and ClientConcurrentUpdate failures

🤖 Generated with Claude Code