fix: give SigningPolicy and NodeClassifier accurate Ready status

[slauger]

Summary

SigningPolicy and NodeClassifier reported a Ready status that could be wrong and stay wrong. A classifier whose Config repointed away from it kept reporting Active until the next informer resync; a spec edit whose re-render failed reported the new, unrendered generation as Active while the servers ran the old one. Both resources had their status written by a controller that only ever touched the ones it happened to render, so anything outside that path got no status at all.

The fix is to let them derive their own status from what was actually rendered. Structurally that is the same shape ReportProcessor already had.

Three CRDs play the same role — a policy resource that the Config controller renders into a ConfigMap or Secret — but only one of them owned its status.

CRD	status written by (before)
ReportProcessor	its own status-only controller, derived from the rendered Secret
SigningPolicy	the Config controller (config_autosign.go)
NodeClassifier	the Config controller (config_enc.go)

This moves SigningPolicy and NodeClassifier onto the ReportProcessor pattern, so no controller writes into another resource's status any more.

• New SigningPolicyReconciler and NodeClassifierReconciler: status-only observers that derive Ready from whether the resource actually reached the servers.
• The Config controller keeps ownership of the rendered Secrets and now reports rendering failures as events on the Config (AutosignPolicyRenderFailed, ENCRenderFailed), matching what it already did for the report webhook.
• updateSigningPolicyStatus and updateNodeClassifierStatus are gone.

How a resource is matched against the rendered file

Each rendered Secret carries an openvox.voxpupuli.org/rendered-from annotation listing the resources its content was built from and the metadata.generation each had at the time. The observers match on that rather than re-parsing the rendered file, which is what lets Ready separate my current spec is in effect from an earlier version of it is:

• A failed re-render leaves the previous Secret in place. Matching on a name — or, for enc.yaml, on the endpoint URL — still finds the resource there, so the new, unrendered generation would report as Active. That case is now RenderedConfigStale.
• enc.yaml carries no resource name at all, so any spec change that keeps spec.url (an auth rotation above all) would otherwise be invisible to the observer.
• The rendered schema no longer has to be declared twice, once with yaml.v3 tags on the render side and once with json tags on the parse side, where a key rename would compile cleanly and flip every resource to NotRendered in production.

The annotation also drives the Secret watches, so an unrelated Secret that merely ends in -enc no longer fans out over every NodeClassifier in the namespace.

Cases that were silent before

The Config controller only ever wrote status on the resources it happened to render, so anything outside that path got no status at all. Deriving it instead closes those gaps:

Reason	Case
NoConfig	a SigningPolicy whose CertificateAuthority no Config references
NotReferenced	a NodeClassifier no Config references
OverriddenByAutosignCommand / OverriddenByExternalNodesCommand	the built-in binary is replaced, so the resource is bypassed
RenderedConfigStale	a Secret was rendered from this resource, but from an earlier generation
RenderSourceUnknown	the Secret predates this mechanism and records no source, so nothing can be concluded from it yet

The override is checked before the Secret is read: a Secret rendered before the override was set still exists, and reporting that as Active would claim an effect the resource no longer has. The override only counts when every referencing Config sets it — one Config opting out does not disable the policy for the one that did not.

Where several Configs render the same NodeClassifier, any one of them holding a Secret that does not match the current generation holds the whole resource out of Ready — whether that Secret is an earlier generation, one rendered from a different classifier, or one recording no source at all. All three are the same statement: a server is running something that is not this generation, so a Config that renders cleanly must not mask a Config that is stuck. A Config that has rendered no Secret at all is the exception, since nothing is mounted there to contradict anything, and the verdict never depends on listing order.

No API or RBAC change — config/rbac/role.yaml and the chart's ClusterRole already grant both status subresources. The kubebuilder markers are narrowed to what the new controllers actually do (read + /status), and the Config controller's now-unused signingpolicies/status and nodeclassifiers/status markers are removed.

Upgrade behaviour

A Secret rendered by an earlier operator version carries no annotation at all, which is not the same as being rendered from nothing. Reading it as "this resource is not in it" would flip every SigningPolicy and NodeClassifier to NotRendered on upgrade — and for a paused Config, whose reconcile returns before the render step, it would stay there. Those resources report RenderSourceUnknown instead, which resolves as soon as the Config controller re-renders.

One limit worth naming: the annotation records metadata.generation, so a re-render that fails without a spec edit — a credential rotated underneath an unchanged spec — leaves the generation matching and the resource reporting Active while the old rendered file stays in effect. That is long-standing behaviour rather than new here (the previous code also returned before writing status on a render error), and the reference pages now say so and point at the Config's render-failure events.

Watches and lookups

• nodeClassifiersForConfig reads nodeClassifierRef off the event object instead of re-fetching the Config. controller-runtime runs a map function against both the old and the new object of an update, so repointing or clearing the field now enqueues the classifier that lost its Config — which previously stayed Active until the informer resync.
• ObservedGeneration is captured before the observation: updateStatusWithRetry re-reads the object, so a spec edit landing in between stamped the new generation onto a verdict derived from the old spec.
• Reference lookups use the registered field indexes, with a new spec.nodeClassifierRef index for Config. findSigningPolicies, the duplicated Config filters and the twin override helpers collapse into shared functions.

Also in this branch

A separate commit renames AGENT.md to AGENTS.md — the name coding agents look for by convention; nothing in the repository referenced the old path — and spells out that commits, PR descriptions and comments carry no AI attribution trailers, footers or session links.

Test plan

• go build ./..., go vet ./..., gofmt clean
• go test ./... — pass, including ./api/v1alpha1/
• golangci-lint run ./... (v2.13.2, built with the repo's Go 1.27 toolchain) — 0 issues
• make manifests generate — no CRD or deepcopy drift
• New: TestSigningPolicyReconcile_Status (9 subtests), TestNodeClassifierReconcile_Status (8 subtests), TestNodeClassifiersForConfig, TestRenderedFromAnnotationRoundTrip, TestRenderedSourceRequests — covering active, each error reason, the stale-render cases, the override and partial-override cases, the multi-Config ordering rule, and the watch mapping for a repointed or cleared nodeClassifierRef
• Mutation-checked: dropping the annotation write, passing nil from either render path, recording generation zero, writing the annotation only on create, reading ObservedGeneration from the re-read object, forcing Ready=True in error cases, removing a Secret-watch suffix filter, and hardcoding the request namespace each turn at least one test red
• Removed the four TestUpdate*Status_* tests, which asserted the cross-controller writes this PR deletes, and the two rendered-file parser tests, whose parsers are gone
• Docs updated: reason tables in docs/reference/signingpolicy.md and nodeclassifier.md, plus the shared mechanism in docs/reference/index.md