simpler check and deps messages

rig/docs/notes/versions.md

@@ -0,0 +1,41 @@
+# ctrl/versions.env
+
+## Pinned toolchain
+
+The single manifest `ctrl/deps.sh` installs from. Every entry is a single binary; none of them needs an apt repo.
+
+- kubectl — fully static
+- kind — libc only
+- tilt — libc + libstdc++ + libgcc (present in base Debian)
+- jq — upstream static build (Debian's is linked against libjq/libonig)
+
+Checksums are the upstream-published SHA256 of the linux/amd64 artifact.
+
+## Bumping a pin
+
+Change the version, then take the checksum from the release's own published list — never hand-edit or hand-copy one from a download you did. For anything hosted on GitHub releases that is:
+
+```
+curl -sSL https://github.com/<org>/<repo>/releases/download/<tag>/checksums.txt \
+  | grep linux.x86_64
+```
+
+(kubectl publishes its own instead: `<KUBECTL_URL>.sha256`.)
+
+There was a `ctrl/versions-refresh.sh` named here that has never existed. If bumping stops being rare enough to do by hand, write it — but a comment pointing at a missing script is worse than no comment.
+
+## ctlptl
+
+Creates a kind cluster WITH a local registry wired in, which is what keeps images off docker.io (an unqualified name means `docker.io/library/<name>`). Same publisher and same archive shape as tilt: binary at the archive root, so `fetch_tgz` handles it with strip=0 and no special case.
+
+## docker compose
+
+The distro docker packages ship the daemon and the CLI but frequently not this, so `docker compose up` fails with "unknown command" on an otherwise working Docker. It is a CLI plugin, found by NAME in a plugin directory, so a copy in the bin dir alone only gives you the retired `docker-compose` v1 spelling; deps.sh links it into `~/.docker/cli-plugins`.
+
+## Node images
+
+Node images shipped with `KIND_VERSION`, pinned by digest so a kind upgrade can never silently move the k8s version. Profiles select one via `K8S_VERSION`. Older entries are kept deliberately: running a trailing-edge control plane is part of simulating a legacy estate.
+
+## Cabinets
+
+Public services dropped in as-is, the upstream image unmodified. The same declaration installs on compose or in the cluster, so a dependency is named once and works either way. Pinned by tag rather than digest because they are ordinary upstream images with no supply chain claim attached — bump freely, and preload them for the offline profile.