fix(webhook): add defensive check for spireEnabled vs identity.type=spiffe lockstep

[akram]

Summary

The ensurePerAgentConfigMap() function now injects/scrubs the spiffe: block based on spireEnabled, while synthesizePipeline() sets identity.type=spiffe based on ClientAuthType == "federated-jwt". These two decisions are currently kept in lockstep by the mTLS-baseline auto-enable (pod_mutator.go:290), but they could diverge during the kagenti-extensions → operator webhook migration.

If a workload's effective config carries identity.type: spiffe while spireEnabled=false, the spiffe: block will be stripped, producing a startup crash ("spiffe identity requires a SPIFFE provider to be injected").

Suggested fix

Add a defensive check: if the synthesized pipeline contains identity.type=spiffe, force spireEnabled=true for the spiffe: block injection, or log a warning about the mismatch.

Context

• Flagged by @huang195 in review of PR #447
• Currently latent — mTLS-baseline keeps the values in sync