feat: Implement NixosConfigurationReconciler with Job-based apply

[kitsunoff]

⚠️ TDD MANDATORY

Tests MUST be written BEFORE implementation code. No exceptions.

All Job lifecycle scenarios, failure modes, and state transitions must have tests written FIRST.

---

Description

Implement NixosConfigurationReconciler that manages NixOS configuration application via Kubernetes Jobs.

Tasks

Test First: Job Lifecycle

• Test: Job succeeded → Applied=True, Ready=True, Machine updated
• Test: Job failed (nix build error) → Stalled=True, reason=ApplyFailed
• Test: Job failed (git clone error) → Stalled=True, reason=GitCloneFailed
• Test: Job failed (SSH lost) → Stalled=True, reason=SSHFailed
• Test: Job timeout → Stalled=True, reason=DeadlineExceeded
• Test: Job pending (insufficient resources) → Stalled=True after 5min
• Test: Job pending (ImagePullBackOff) → Stalled=True, message contains error
• Test: Job pending (secret not found) → Stalled=True, message contains error
• Test: Job has correct owner reference
• Test: Config deletion cancels running job
• Test: Config deletion applies onRemoveFlake (max 3 retries)
• Test: Config deletion clears Machine status
• Test: Machine not ready → Ready=False, reason=MachineNotReady, requeue

Test First: Concurrency Protection

• Test: Per-machine concurrency → Only one job per machine at a time
• Test: Global concurrency limit → Max concurrent jobs respected
• Test: MachineInUse condition → Set when another config is applying to same machine

Core Reconciler

• Implement NixosConfigurationReconciler struct
• Implement Reconcile() with observedGeneration updates
• Implement SetupWithManager() with Job and Secret watches
• Add finalizer handling for deletion with onRemoveFlake support (max 3 retries)

Job Management

• Implement createApplyJob() with proper security context
• Add nio.homystack.com/machine label to Jobs for per-machine filtering
• Set owner references for garbage collection
• Implement checkJobProgress() for monitoring
• Implement handleJobSuccess() with status updates
• Implement handleJobFailure() with error extraction from logs
• Implement updateProgressFromLogs() for real-time progress
• Implement hasActiveJobForMachine() for per-machine concurrency
• Implement countActiveJobs() for global concurrency limiting

Machine Integration

• Write tests for Machine watch triggers
• Watch Machine resources for state changes
• Wait for Machine.Discoverable before applying
• Update Machine status on successful apply
• Clear Machine status on config deletion

Git Operations

• Write tests for additionalFiles injection
• Clone repository with credentials
• Checkout specific ref (branch/tag/commit)
• Inject additionalFiles (Inline, SecretRef, NixosFacter)
• Calculate configuration hash for change detection

Apply Operations

• Support nixos-rebuild switch for updates
• Support nixos-anywhere for full installs
• Handle onRemoveFlake on deletion (max 3 retries, then proceed anyway)
• Implement timeout handling (30min rebuild, 1h full install)

State Machine

Pending --> Reconciling --> Applied
              |               |
              v               |
           Stalled <----------+
              |
              v (delete)
           Deleting --> ApplyingRemoval --> Deleted
                              |
                              v (3 failures)
                           Finalizing

Concurrency Model

1. Per-machine protection: Check hasActiveJobForMachine() before creating new job
2. Global limit: Check countActiveJobs() against MaxConcurrentJobs
3. Job labels: Include nio.homystack.com/machine for filtering

Reference

See docs/kubebuilder-migration-analysis.md sections 4, 15-16, 22, 24, 26.