feat(target-operatorbox): the experiment lands — phase 1

[iAlexeze]

Summary

The experiment from #260 reaches phase 1.

Each serve target can now carry its own operatorBox. The reconciler selects
the box from the CR's serve-alias / serve-target annotations — different
resources, different lifecycle hooks, different preReconcile gates per surface.

operatorBox:                     # CRD-level fallback
  reconciler:
    hooks:
      location: github.com/myorg/myoperator/hooks
      function: AppHooks
      args:
        featureEnabled: '{{ .external.flags.body }}'
        inBusinessHours: '{{ inBusinessHours }}'

serve:
  target:
    v2-enabled:
      primary: true
      operatorBox:               # hooks — args forced, gate active
        preReconcile:
          enqueueGate:
            when:
              - field: '{{ inBusinessHours }}'
                equals: "true"
        reconciler:
          hooks:
            args:
              featureEnabled: "true"
              inBusinessHours: '{{ inBusinessHours }}'

    regional:
      operatorBox:               # declarative — forEach over regions
        preReconcile:
          reconcileGate:
            when:
              - field: "{{ len .spec.regions }}"
                notEquals: "0"
        onCreate:
          deployments:
            - name: "{{ .metadata.name }}-{{ .item }}"
              image: "{{ .spec.image }}"
              forEach:
                field: spec.regions
                as: item
          namespaces:
            - name: "{{ .metadata.name }}-{{ .item }}"
              forEach:
                field: spec.regions
                as: item

When a CR switches target, the previous surface's resources are cleaned up via
a label-selector sweep on orkestra-owner=<name>.<prevTarget>.
keepPreviousSurface: true skips the sweep.

Documentation updated.

Test plan

• Target switch cleans up previous surface resources (namespaced + cluster-scoped)
• forEach resources swept correctly when spec fields are cleared before cleanup
• preReconcile gates (enqueueGate / reconcileGate) fire per target
• keepPreviousSurface retains old resources across target switch
• 409 on target switch without ?override=true
• make unit-test
• make ork

---

This is still an ongoing experiment of what the target surface could mean for the runtime.