fix: skip init-data-owner in namespaces enforcing restricted Pod Security

[stubbi]

Follow-up to #608 (which fixed #607), addressing the concern @jtatum raised there.

Problem

#608 added the init-data-owner init container, which runs as root with CAP_CHOWN and is on by default. A namespace that enforces the restricted Pod Security Standard rejects such a pod at admission. After an operator upgrade, the next rollout of an existing instance in such a namespace would delete the running pod and then fail to create its replacement.

Change

spec.storage.fixOwnership becomes tri-state:

Value	Behavior
unset (default)	Run init-data-owner, except in namespaces labelled pod-security.kubernetes.io/enforce: restricted
true	Always run it
false	Never run it

• The +kubebuilder:default=true marker is removed so that unset is distinguishable from an explicit true. fix: chown the data volume root to the pod UID before OpenClaw starts (#607) #608 has not been released, so no stored objects depend on the default.
• The controller reads the instance's Namespace with an uncached reader and resolves the default in memory only, the same way cluster defaults are applied. The stored spec is never written back, so relabelling the namespace takes effect on the next reconcile.
• New RBAC rule: get on namespaces (kubebuilder marker, generated role, Helm chart rules, OLM bundle). It also works in watchNamespaces mode, because a namespaced Role can grant get on its own Namespace object.
• If the namespace cannot be read while fixOwnership is unset (for example RBAC from an older install), the controller does not guess. Reconciliation fails before any managed resource is touched, with a ReconcileFailed event and Ready condition that name the missing get on namespaces, and is retried. The existing StatefulSet stays unchanged. An explicit true/false skips the lookup.
• Regenerates the CRDs and docs/api-reference.md. The latter also fixes the API Docs Sync check that fix: chown the data volume root to the pod UID before OpenClaw starts (#607) #608 left failing on main.

Testing

• make test passes locally (unit + envtest).
• New envtest suite internal/controller/data_owner_pod_security_test.go: default in an unlabelled namespace, baseline, restricted, explicit true and false, that the stored spec stays unset, that a Namespace-read failure returns an error and leaves a restricted-compatible StatefulSet unchanged, and that explicit values skip the lookup.
• Unit test for the label helper in internal/resources/data_owner_test.go.
• hack/check-helm-rbac-sync.sh passes. I could not run hack/check-helm-cluster-rbac.sh locally (no helm), so that one is covered by CI only.
• Not exercised on a real cluster with Pod Security Admission enforcing; envtest does not create pods.

Not covered

Namespaces exempted from Pod Security Admission through the admission configuration still carry the label, so the init container is skipped there by default. Set fixOwnership: true in that case. Other policy engines (Kyverno, Gatekeeper) are not detected; use fixOwnership: false.

🤖 Generated with Claude Code

https://claude.ai/code/session_011HrjPjDpPgTdCFicDWQpvH

[jtatum]

Thanks for addressing the restricted-namespace upgrade concern from #608. The namespace-aware default is useful; the remaining reliability concern is the Namespace-read failure path below. Validated locally with OpenClaw 2026.9.4 on Kubernetes 1.36.4.

[stubbi]

Merge order note (maintenance pass, 2026-10-11). The open stubbi PRs are stacked so they apply cleanly in this order: #623 → #627 → #620 → #618 → #617 → #628 → #629. This is position 4 of 7. This branch has #620 (and everything below it) merged in, so until those land the diff here also shows their changes; once they are squash-merged, "Update branch" reduces it to this PR's own changes without conflicts. #623 is at the bottom because the required E2E check cannot pass without its sticky /tmp fix (OpenClaw >= 2026.9.6 crash-loops otherwise). Branch protection requires an up-to-date branch, so after each merge click "Update branch" on the next PR and let CI re-run before merging it.