Feat: add MTLSReady condition to AgentRuntime status

[varshaprasad96]

Summary

• Add MTLSReady condition logic to the AgentRuntime reconciler (T006 from mTLS spec)
• Controller evaluates SPIRE availability on each reconcile by checking for spire-agent-socket or svid-output volumes in the workload's pod template
• Emits Warning Event with actionable guidance when SPIRE is missing but mTLS is enabled

Condition States

Reason	Status	When
SPIREAvailable	True	SPIRE volumes detected in workload pod template
SPIREUnavailable	False	mTLS mode is permissive/strict but no SPIRE volumes found
MTLSDisabled	True	mTLSMode explicitly set to disabled
SPIREAssumed	True	Sandbox workloads (webhook handles injection at pod CREATE)

Key Design Decisions

• MTLSReady=False does NOT block Ready=True — it's informational for fleet-wide mTLS rollout tracking
• SPIRE detection checks pod template volumes, not running pod state — this is the right layer since the webhook injects volumes at admission time
• Sandbox workloads assume SPIRE is available since typed PodSpec is not accessible from unstructured objects

Test plan

• All unit tests pass (make test)
• Deploy agent with SPIRE → verify MTLSReady=True/SPIREAvailable
• Deploy agent without SPIRE → verify MTLSReady=False/SPIREUnavailable + Warning Event
• Deploy agent with mTLSMode: disabled → verify MTLSReady=True/MTLSDisabled

Jira: RHAIENG-4928
Spec: specs/003-mtls-transport-security (PR #401)

🤖 Generated with Claude Code

[pdettori]

Clean implementation of the informational MTLSReady condition (T006). Code follows existing controller patterns consistently — accessor, condition API, event emission with nil-check guard.

Verified:

• MTLSReady=False does NOT block Ready=True ✓
• Sandbox path returns SPIREAssumed via nil-podSpec check (not nil-function-pointer) ✓
• RBAC diff is controller-gen consolidation — no permission change (serviceaccounts and services already had identical verbs) ✓
• Warning Event emits actionable guidance ✓
• All 16 CI checks passing ✓