Fix VirtualMCPServer reconciliation

[jhrozek]

Summary

• ConfigMap watches for VirtualMCPServer's auth config (authz policy ConfigMap,
  provider/trusted-issuer CA bundles) listed every VirtualMCPServer in the
  namespace and filtered in memory on each event — O(all VMCPs) work per
  ConfigMap change. Replaced with a field index (virtualMCPServerConfigMapIndex)
  queried via client.MatchingFields.
• Three call sites in runAuthValidations logged a failed status write
  (applyStatusUpdates) and then returned as if the terminal validation had
  completed cleanly, silently leaving the object's status stale/unwritten with
  no retry. They now return the status-write error so controller-runtime
  requeues with backoff.

Refs #6205 (SPIFFE client-auth epic) — this is a general reconciliation
correctness/scale fix, not scoped to that epic.

Type of change

• Bug fix

Test plan

• Unit tests (task test)

Added TestVirtualMCPServer_RunAuthValidations_StatusWriteFailurePropagates,
which injects a failing status-subresource write via interceptor.Funcs and
asserts runAuthValidations returns a non-nil error instead of (false, nil).
Verified it fails against the pre-fix behavior and passes against the fix.

API Compatibility

• This PR does not break the v1beta1 API

Does this introduce a user-facing change?

No.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 68.42105% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.08%. Comparing base (0fb54d4) to head (dcb3473).

Files with missing lines	Patch %	Lines
...perator/controllers/virtualmcpserver_controller.go	12.50%	7 Missing ⚠️
...or/controllers/virtualmcpserver_authz_configmap.go	83.33%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6465      +/-   ##
==========================================
+ Coverage   78.02%   78.08%   +0.05%     
==========================================
  Files         767      767              
  Lines       74273    74281       +8     
==========================================
+ Hits        57955    58003      +48     
+ Misses      16313    16273      -40     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JAORMX]

The indexed reverse lookup preserves the existing authz, upstream CA, and trusted-issuer CA ConfigMap paths while removing the namespace-wide scan. Namespace scoping and error propagation both look correct, and the operator tests and CI are green.

Two non-blocking follow-ups would strengthen this:

• cover the other two changed status-write error branches (CA bundle validation and authz/upstream validation), since the new regression test currently exercises only invalid AuthServerConfig;
• add explicit coverage for the trusted-issuer CA-bundle index path.

The ConfigMap-watch comments also still describe only incoming authz ConfigMaps even though the watch covers CA bundles too; worth updating when convenient.

None of these are blockers for this correctness/scalability fix.