[ThoSap]

RoleReconciler read the password Secret before the try block. If the Secret was missing or had the wrong type, getSecretRefCredentials threw outside the try, so handleError did not run. The Role kept its old phase, for example READY, and observedGeneration stayed at the old generation, while each reconcile failed until JOSDK stopped the retries. The other five reconcilers do all their work inside the try and set ERROR in this case.

Found in the review of #91. It is the same type of bug as #89.

What changed

1. The Secret is read inside the try block. A missing or invalid Secret now sets ERROR with the message, for example Secret reference not found [...], and the operator tries again after 60 seconds. When the Secret appears, the Secret event source still starts a reconcile at once.
2. New test. A READY Role points passwordSecretRef to a missing Secret and must go to ERROR. Then it points back to the existing Secret and must go to READY.

Checks that CI cannot do

• Without the fix in RoleReconciler, the new test fails: the status is never written, so the wait for observedGeneration times out.