Converge remaining ad-hoc domain/driver derivations onto utils/domain.sh

[fentas]

Follow-ups deferred from #88's review loop (3 rounds, Copilot + subagent). #88 established utils/domain.sh (domain::resolve / domain::driver / domain::require_driver) as the single domain-resolution + driver-identity point; these sites still derive independently:

Independent yq '.kind' sniffs → domain::driver:

• lo:203 (_lo_header), lo:284 (main::down — ALSO missing // "": a kind-less spec yields the literal null and routes to provision::dispatch_destroy; and it still uses the maskable yq | tr pipeline fix(cli): single domain-resolution point — env precedence, driver gates, honest errors #88 removed elsewhere)
• libs/provision:180/319/367, libs/status:140, libs/kubehz/main:82/108, libs/kubehz/hosted:21, libs/bootstrap:100/937, libs/addons:53/271, libs/inventory/main:71, libs/audit:142, libs/lint:459, libs/use:74 (display-only), libs/doctor:96

Behavioral leftovers:

• libs/image:33 — image::_registry_tls keys off DOMAIN_NAME while image::list/cache use the inherited domain local: --domain X can mix X's cache IP with DOMAIN_NAME's TLS scheme.
• libs/image — the driver gate now precedes the LOK8S_REGISTRY_IP_CACHE check, so the documented env override is unreachable for non-lo domains (previously env-only worked, e.g. a shared cache). Decide: allow the override to bypass the gate, or drop the claim from the error text.
• lo clean on a driver-migrated/deleted domain skips registry cleanup (visible warn + manual docker rm hint) — consider a name-based sweep.
• LOK8S_DOMAIN_EXPLICIT can be set by a post-positional --domain that argsh never parses (no reachable consumer divergence today — main::use positionals win — but it's an exported env a future consumer could trust).
• Nested lo invocations (Tilt local()) re-print the env-vs-.active notice per call — consider dedup via an env marker.

🤖 Generated with Claude Code

[fentas]

Scope after #139 — this issue stays OPEN. Recording the remainder explicitly so
none of it is dropped when the PR merges.

Done in #139

• All thirteen private yq -r '.kind' | tr driver derivations converged onto
  domain::spec_driver (lo, provision, bootstrap ×2, status, audit, lint,
  doctor, use, addons ×2, inventory, kubehz ×2). A sweep + allowlist + a
  stale-allowlist check gate the fourteenth copy. Round-1 review widened the
  sweep: it used to require =$(yq, so the quoted spelling
  k="$(yq -r '.kind' …)" — the pre-fix form of libs/use:74 — evaded it.
• image::_registry_tls keyed off DOMAIN_NAME while image::list / cache
  honoured --domain X; it takes the domain explicitly at every call site now.
• The Lo-driver gate ran before the LOK8S_REGISTRY_IP_CACHE check, making the
  documented override unreachable. An explicit override now skips the gate.

Still open

1. lo clean skips registry cleanup on a driver-migrated domain. The sweep
   is gated on the CURRENT driver, so a domain that was Lo and is now
   KubeOne/Capi leaves its cache registry container and volume behind with
   nothing that removes them.
2. LOK8S_DOMAIN_EXPLICIT can be set by a post-positional --domain that
   argsh never parses. No reachable consumer today, so it is latent rather
   than live — but main::use reads the flag to decide whether a bare lo use
   may rewrite .active, which is a write, so it should not stay latent by
   accident.
3. Nested lo invocations re-print the env-vs-.active notice. A lo
   that shells out to lo repeats the warning once per level; it should be
   printed once per outermost invocation.
4. libs/kubehz/hosted sends the spec kind in its original case as a WIRE
   field ("KubeOne", not "kubeone"). Deliberately not converged — it is a
   cross-repo contract, not a driver lookup, and it is the one entry in the
   drift gate's allowlist that is a deferral rather than a category difference.
   Closing it needs an API-side case check first.