fix(pvc): converge external populator dependency handoffs

[weicao]

Problem

An external-populator target PVC can reconcile before its guest PV or populate-helper dependency reaches an authoritative state. Later PV/helper cache convergence does not enqueue the target PVC, so the handoff can remain incomplete with timer requeues at zero.

The same reconcile path performs direct optimistic-lock host materialization writes after constructing SyncerPatcher. A later deferred host patch could therefore use the stale pre-write baseline and overwrite another writer or replay stale state.

Change

• index guest PVCs by exact UID and watch guest PV and PVC dependency events through the real PVC controller builder;
• map only authoritative namespace/name/UID matches back to the exact external-populator target PVC;
• distinguish create/update, delete tombstones, terminating objects, absent dependencies, and recreate events without adding a polling timer;
• propagate mapper lookup failures and fail closed instead of falling back to stale identity;
• rebase only the host half of SyncerPatcher to the server-returned object/resourceVersion after direct materialization or a fresher host target read;
• detect Conflict inside Kubernetes aggregate errors and request a bounded fresh reconcile instead of silently overwriting concurrent metadata/resource changes.

NotFound while mapping means skip the current event; the watched authoritative create/recreate event supplies the later wake. A missing host PV in materialization retains the existing scoped 2s convergence result. An invalid rebase object or empty committed resourceVersion is an error.

Commit stack

This PR is cumulative on fix/external-populator-topology-gate and preserves the already reviewed exact prerequisite heads:

• 22d640701c1468285571edee50f8ea6775944e53 terminating-dependency guard
• 82b48a2ee57b2edc19b4f77769e3a6ac96e2e679 effective host StorageClass projection
• 42a462faadada201fec1bd539d83f419e4822f81 canonical tests-only dependency-wakeup RED
• f2206ed0319f9bf519dc4eeeebe85724f5968a78 implementation and negative/wiring coverage

Final tree: f36d7e9d3e0da9406df38e67c95a9655af84abd0.

Design contract

1. API/schema: the wakeup implementation adds no public API, CRD, or new configuration surface. This cumulative PR also carries the already accepted 82b48a2e chart/config/RBAC projection prerequisite; f2206ed0 adds no chart or RBAC delta.
2. Runtime wiring: real ModifyController/builder/cache/informer coverage proves both dependency event types reach the exact target.
3. Concurrency: direct-write rebase preserves the guest half; a concurrent host writer causes Conflict, remains unmodified, and is recomputed from a fresh second reconcile.
4. Convergence: canonical PV NotFound→create, helper absent→create, and PV Pending→Bound cases converge with exact target wake and timer0.
5. Lifecycle: delete/recreate, ordinary Terminating, absent, and NotFound paths are separate and tested.
6. Failure behavior: lookup and rebase failures fail closed; no stale-baseline fallback.
7. Compatibility: full resource tree plus PVC/PV/StorageClass and chart suites remain green.
8. Operations/evidence: source-only change; no image build/push, live mutation, cleanup, or frozen-scene action. Runtime/product N=0 pending the independent Test lane.

Verification

• focused canonical RED→GREEN, negative mapper, real wiring, class-3 concurrent-writer, and rebase fail-closed tests
• go test ./pkg/controllers/resources/persistentvolumeclaims -count=1
• go test -race ./pkg/controllers/resources/persistentvolumeclaims -count=1
• go test ./pkg/controllers/resources/... -count=1
• go test ./pkg/patcher ./pkg/controllers/resources/persistentvolumes ./pkg/controllers/resources/storageclasses -count=1
• go vet ./pkg/controllers/resources/persistentvolumeclaims ./pkg/patcher
• helm unittest chart (20 suites, 219 tests)
• git diff --check