feat(serve): add modes and apply-time controls

[iAlexeze]

Summary

Adds three new control blocks under serve giving platform teams granular control over the Gateway API surface, override behaviour, and full CR routing.

serve.modes

Controls which apply modes are available for a CRD. Both default to true for backward compatibility.

serve:
  enabled: true
  modes:
    target: true   # target mode — submit fields with a target identifier
    cr: false      # full CR mode — submit a complete Kubernetes CR

  targets:
    old-client:
      primary: true
      modes:
        target: false   # disable target mode for old-client

At least one mode must be enabled. ork validate enforces this. Can be set at the CRD level and per target.

serve.apply.overrides

Controls whether request-level overrides (?overwrite=true and ?override=true) are honoured. Both default to true (allow overrides). This is a second line of defence — even if the caller passes the override parameter, the gateway can reject it based on the configuration.

serve:
  enabled: true
  apply:
    overrides:
      resourceConflict: true   # allow ?overwrite=true (SSA field ownership)
      targetConflict: false    # disallow ?override=true (routing surface changes)

  targets:
    staging:
      primary: true
      apply:
        overrides:
          targetConflict: true   # only staging allows routing changes

resourceConflict — when true, callers can pass ?overwrite=true to force field ownership on server-side apply. When false, the override is rejected regardless of the request.

targetConflict — when true, callers can pass ?override=true to change the routing surface (target/alias) of an existing CR. When false, the override is rejected and routing surface changes are always disallowed.

Both settings can be set at the CRD level (fallback) and per target. Target-level wins when set.

serve.targets[<name>].fieldSelector

Links full CRs to a target based on field values. When a CR matches ALL key-value pairs, it is automatically routed to that target — enabling per-target response config, tokens, permissions, and mode enforcement for full CR mode.

serve:
  enabled: true
  targets:
    internal:
      fieldSelector:
        spec.workloadType: app
        metadata.name: internal-memo
      modes:
        cr: false          # internal disallows full CRs

fieldSelector — a map of dot-notation field paths to values (max 3 per target). This is a true selector — like Service → Pod selection. Each target must have a unique selector. ork validate enforces uniqueness and warns if a target has cr: false but no field selector.

Validation rules:

• Max 3 field selectors per target
• Unique across targets — no two targets can share the same path:value pair
• Must be valid dot-notation paths (e.g., spec.mealPlan: dinner)
• Values must be non-empty

The target becomes the owner of the matched CR — controlling its mode, response config, tokens, and provenance.

Test Plan

• ork validate catches at least one mode enabled
• ork validate catches target mode disabled → target set
• ork validate catches max 3 field selectors
• ork validate catches duplicate field selectors across targets
• ork validate warns if CR mode disabled with no field selector
• Gateway rejects target mode when disabled
• Gateway rejects CR mode when disabled
• Gateway routes full CRs to target via field selector
• Gateway stamps field selector provenance annotations
• Per-target modes override CRD-level
• make unit-test clean
• make ork clean

---

Platform teams can now enforce intent-first delivery, control override behaviour per target, and route full CRs to targets based on field values — just like a Service selector.