[Reliability] Harden operator reconciliation and deployment workflows

[loveRhythm1990]

Summary

• enqueue CNSet and DNSet only when the backing LogSet StatefulSet reserve ordinals change, without altering create/delete lifecycle ordering
• support namespace-aware internal LogSet references through shared owner/reference matching rules
• reconcile the managed shape of CN metrics Services while preserving unrelated metadata; a foreign-owned name collision is left untouched and cannot block CN rollout or scaling
• keep Kruise Pod/PUB and custom-resource admission fail-closed, document the invariant, and test outage plus recovery after the established E2E suite
• package the existing OpenKruise 1.8.3 dependency without modifying its Chart content or version
• make local, E2E, and release Chart packaging deterministic in workspaces containing stale dependency archives
• pin setup-envtest, golangci-lint, Go, GitHub Actions, and Ginkgo; align documented local verification with CI
• allow reviewed top-level troubleshooting Markdown while ignoring evidence/generated subtrees by default

Regression coverage

• update-only reserveOrdinals predicate, LogSet owner filtering, namespace-aware reference matching, and CNSet/DNSet request mapping
• CN metrics Service drift recovery, stable CNSet selector with empty TypeMeta, and foreign-owner collision behavior
• rendered webhook policy, ignored-lock isolation, and dirty-workspace packaging
• Kind outage scenario covering unrelated API availability, Pod/Kruise CR fail-closed behavior, Helm upgrade, and webhook recovery
• serialize the resource-intensive maximum-name cluster spec on the shared single-node Kind cluster

Verification

• make ci-reviewable with Go 1.23.1
• make verify-generated
• make verify-chart
• make go-lint with golangci-lint v2.1.6
• make check-license
• actionlint
• focused controller tests and E2E suite compilation

The Kind outage scenario is wired into CI and was not run locally.

The OpenKruise StorageClass RBAC mismatch tracked by #610 is intentionally deferred to a separate change because it requires publishing a customized dependency Chart.

Refs #615
Refs #603

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request