fix: reconcile ListenerSet when referenced TLS Secret changes

[zanarellidev]

What this PR does / why we need it:
validateSecretForReconcile indexed Secrets referenced by Gateways (and other policies) but not by ListenerSet certificateRefs. After #9488 fixed #9486 and stopped treating every Secret as relevant, creating or renewing a TLS Secret for a ListenerSet no longer triggered reconcile, so the ListenerSet could stay Programmed=False (typical cert-manager flow).

This adds a secretListenerSetIndex, wires it into the ListenerSet indexers and the offline controller client, and includes ListenerSet refs in the Secret predicate (gated on listenerSetCRDExists).

Which issue(s) this PR fixes:
Fixes #9614

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: N/A: no API changes.
• Required checks pass: Scoped unit tests for the touched kubernetes provider package pass locally (go test ./internal/provider/kubernetes/ -run 'TestValidateSecretForReconcile|TestOfflineGatewayAPIController'). Full make generate gen-check / make lint / coverage left to CI.
• Tests added/updated: Added ListenerSet cases to TestValidateSecretForReconcile and registered secretListenerSetIndex in the offline controller index smoke test.
• Docs: N/A: no user-facing docs change beyond release notes.
• Release notes: Added release-notes/current/bug_fixes/9614-listenerset-secret-reconcile.md.
• Generated files committed: N/A: no generate/API/helm changes.
• Scope & compatibility: Scoped to Secret→ListenerSet indexing/predicate; backward compatible.
• Codex review: Will request after open.
• Copilot review: Will request after open.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	6569e5a
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a70096d1c9eda0008e80682
😎 Deploy Preview	https://deploy-preview-9634--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.07%. Comparing base (b710dd4) to head (5d93823).

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/predicates.go	73.07%	5 Missing and 2 partials ⚠️
internal/provider/kubernetes/indexers.go	76.47%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9634      +/-   ##
==========================================
+ Coverage   76.04%   76.07%   +0.03%     
==========================================
  Files         259      259              
  Lines       43275    43319      +44     
==========================================
+ Hits        32907    32957      +50     
+ Misses       8178     8172       -6     
  Partials     2190     2190              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[arkodg]

we return false for 1 bad parentRef instead of finding any valid secrets that need to be reconciled
this bug exists in another place

  diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
  --- a/internal/provider/kubernetes/predicates.go
  +++ b/internal/provider/kubernetes/predicates.go
  @@ -388,11 +388,11 @@ func (r *gatewayAPIReconciler) isGatewayReferencingSecret(nsName *types.Namespa

   	for i := range gwList.Items {
   		gw := &gwList.Items[i]
  -		if !r.validateGatewayForReconcile(gw) {
  -			return false
  +		if r.validateGatewayForReconcile(gw) {
  +			return true
   		}
   	}
  -	return true
  +	return false
   }

   func (r *gatewayAPIReconciler) isListenerSetReferencingSecret(nsName *types.NamespacedName) bool {
  @@ -419,12 +419,12 @@ func (r *gatewayAPIReconciler) isListenerSetReferencingSecret(nsName *types.Nam
   		if err := r.client.Get(context.Background(), key, gw); err != nil {
   			r.log.Error(err, "failed to get parent Gateway for ListenerSet",
   				"namespace", ls.Namespace, "name", ls.Name)
  -			return false
  +			continue
   		}
  -		if !r.validateGatewayForReconcile(gw) {
  -			return false
  +		if r.validateGatewayForReconcile(gw) {
  +			return true
   		}
   	}
  -	return true
  +	return false
   }

can this be addressed ?

[zanarellidev]

Applied in 6569e5a: both secret predicates now return true on the first managed parent and continue past a missing/unmanaged one. Added mixed valid/invalid parent unit coverage.