tare uninstall

Reverse "tetrate agentrouter dataplane install": uninstall the Helm release, delete the system
and dataplane namespaces (auto-patching stuck finalizers), and remove
Agent Router-owned CRDs.

Mostly cluster-only. The data plane URL stays registered and the service-account
identity is not revoked — use the Admin Console or 'tetrate agentrouter identity' for those.

After the Helm release is removed (phase 2), the CLI reports the uninstall as
an event to the management plane via a sync POST to /v1/dataplane-install-events
so the data plane's deployment history shows the operation. The POST uses the
identity file's SA token. On management-plane 5xx or network failure the CLI
writes the event to a ConfigMap in tars-system as a fallback (which may not
survive the imminent namespace deletion — see ADR 046 §10). The POST never
blocks teardown and never changes the CLI's exit code.

Phases:
  1. Preflight (Helm 3+, kubectl, cluster)
  2. helm uninstall <release> -n <system-namespace>
  --- between phases 2 and 3: sync-POST uninstall event to the
      management plane (+ CM fallback on 5xx)
  3. Patch finalizers in the namespaces + delete GatewayClass tars-egress
  4. Delete namespaces (system, dataplane)
  5. Wait for namespaces to disappear
  6. Delete Agent Router-owned CRDs (skipped if other releases share
     them; see --force)

Examples:
  # Standard teardown after confirmation prompt.
  tetrate agentrouter dataplane uninstall identity.json

  # Non-interactive (CI).
  tetrate agentrouter dataplane uninstall identity.json --yes

  # Stuck finalizers: bypass controller cleanup and patch them empty.
  tetrate agentrouter dataplane uninstall identity.json --yes --force

  # Multi-DP cluster: leave CRDs in place so other releases keep working.
  tetrate agentrouter dataplane uninstall identity.json --yes --keep-crds

  # Preview without touching the cluster.
  tetrate agentrouter dataplane uninstall identity.json --dry-run

Safe to re-run: yes -- every phase tolerates a release, namespace,
  GatewayClass, finalizer or CRD that is already gone and carries on with
  whatever is left. Pass --yes to skip the typed confirmation on the retry.

Usage:
  tare uninstall <identity-file> [flags]

Flags:
      --argocd-namespace string   Namespace where ArgoCD Applications live; pre-check uses this to detect mixed-deployment (default: argocd). Set to empty string to disable the check.
      --context string            kubeconfig context to act on (default: the current context)
      --dry-run                   Print the plan and run helm uninstall --dry-run; no cluster mutation
      --force                     Override the multi-DP guard and delete CRDs even when other releases share them
      --ignore-argocd             Proceed even when ArgoCD manages the system namespace (mixed-deployment override; see ADR 046 §12.13).
      --ignore-flux               Proceed even when a Flux HelmRelease manages the system namespace (mixed-deployment override).
      --keep-crds                 Leave CRDs in place (use on shared/multi-DP clusters)
      --kubeconfig string         Path to the kubeconfig file (default: $KUBECONFIG, then ~/.kube/config)
      --timeout string            Per-phase wait timeout (default "5m")
  -y, --yes                       Skip the confirmation prompt; required when there is no terminal to prompt on

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr