fix: keep on update what the update does not change

[Alex (Alexkuva)]

What does this PR change?

• kaiten entitlements update, with inline flags, reads the entitlement first and sends back every field the flags do not name: the reset window, the warning threshold, the icon, unit and sale-unit labels, userFacing and the display order. Groups stay as they are unless --group-slug is given. --name is no longer required on update. --file and --payload are still sent as written, as a full replacement.

• kaiten licenses entitlements update reads the grant and keeps its allowance (limitCapExceededOveragePercent) when the new value is a finite number, unless --overage-percent gives one. An unlimited value, or a grant that was unlimited, leaves the allowance to the API.

• New flags on entitlements create and update:

  • window: --reset-period, --reset-anchor;
  • threshold: --warning-threshold-percent;
  • presentation: --icon, --unit-singular, --unit-plural, --user-facing, --display-order;
  • sale unit: --sale-unit-singular, --sale-unit-plural, --sale-unit-factor.

  An empty label or icon removes it.

• --overage-percent on licenses entitlements associate and update.

• The README explains the update semantics, with a soft-limit example.

Why?

The API replaces an entitlement or a grant with what it is sent, and both commands sent only what their flags held:

Command	Before
entitlements update monthly-orders --description …	Refused: 400 UpdateEntitlement.ImmutableResetPeriod. A periodic entitlement's window has to be sent back.
entitlements update menu-items --description …	Reset the warning threshold, icon, unit labels, userFacing and display order.
licenses entitlements update premium-v2 monthly-orders --number 1500	Turned a 20 % soft limit into a hard one: the API derives an omitted allowance from the value.

The SDK could not send any of these fields until kaitencloud/sdk-go#5, released as v0.1.0, which go.mod now requires.

Testing

• go test -race ./...: pass. New entitlements_test.go and licenses_test.go run the commands through the root against a fake API that records every call:
  • inline update reads, then sends what it read with the named fields changed;
  • an empty --icon removes the icon;
  • --payload is sent as written, without reading first;
  • create sends the new fields;
  • five allowance cases on grant update;
  • associate with and without --overage-percent.
• Mutation check: making keptOveragePercent keep nothing fails the soft-limit case.
• golangci-lint v2.12.2: 0 issues.
• Note: CI's vulnerability scan runs on Go 1.25.x, which is no longer patched (nine stdlib advisories fixed in 1.26.9). It fails on main too since 2026-10-08. A separate PR moves the scan and the release build to 1.26.

Checklist

• I have read CONTRIBUTING.md.
• Every commit in this PR includes a valid DCO Signed-off-by line.
• I have the right to submit all material in this PR.
• I have not included secrets or confidential data.
• I have updated tests where appropriate.
• I have updated documentation where appropriate.
• I have preserved required third-party licenses and attributions.

🤖 Generated with Claude Code · ✅ Tested and approved by Alex (@Alexkuva), maintainer