Function api_url_prefix 

pub fn api_url_prefix() -> String

Canonical /apis/<GROUP>/<VERSION>/ prefix as an owned String — the ONE K8s REST-path shape every typed Api::namespaced / Api::all primitive built off a tatara CRD kind (Process, ProcessTable, EphemeralPool, EphemeralAllocation) emits at kube::Api::resource_url. Peer to api_version — composed from the SAME GROUP + VERSION pair, wrapped in the fixed /apis/{…}/ HTTP-path envelope that the K8s API server exposes every custom-resource group under.

Pre-lift the wire-form literal "/apis/tatara.pleme.io/v1alpha1/" recurred at ELEVEN hand-authored sites across three separate test modules — six across tatara-reconciler::context (process_api, process_table_api, processes_all_api scope pins), four across tatara-pool-reconciler::context (pool_api, allocation_api, pools_all_api, allocations_all_api scope pins), and one at tatara-github-watcher::handler (allocation_api scope pin) — each restating the same URL prefix a bump of GROUP or VERSION would silently miss at every one. Post-lift each of the eleven sites composes the prefix through this substrate function, so a future group rename or v1alpha1 → v1beta1 bump lands at ONE composer and the eleven downstream scope guards inherit the shape mechanically.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs. A regression that drifted the URL prefix at ONE site (a group typo, a /apis/ → /api/ mis-spelling, a stale v1alpha1 left behind after a workspace-wide VERSION bump) surfaces at the [api_url_prefix_tests] pins below rather than as silent scope-guard drift between the three reconciler + watcher test suites (which pre-lift already disagreed with each other on nothing but were free to drift independently).