fix(controllers): watch pods in RC and fall back to selector labels in RS

[indyjonesnl]

Problem

Two controller reaction-latency bugs surfaced by conformance:

1. ReplicationController only watched its own resource and was driven by a 30s resync. Pod deletions (kubelet eviction, OOM, manual) took up to 30s to trigger a replacement create — conformance probes time out.
2. ReplicaSet picked owned pods exclusively by `ownerReferences[].uid` matching the RS UID. Orphaned pods (RS recreated, owner stripped during foreground deletion) were ignored even when their labels still matched `spec.selector` — leading to pods being respawned alongside the orphans, exceeding the replica count.

Fix

• RC: add a pod watch keyed by the same prefix as the RC, so any pod lifecycle event enqueues the owning RC for immediate reconcile. The 30s resync remains as a safety net.
• RS: when scanning for owned pods, first try the ownerReference match (fast path), then fall back to label-selector match (`spec.selector.matchLabels` + `matchExpressions`) for any pod missing an ownerReference. This catches orphans without recreating duplicates.

Verification

`cargo build --workspace --locked` clean. Depends on #32 for green CI.