Fix pull-secret namespace handling for HyperShift

[caxu-rh]

Problem

resolvePullSecret validates an explicit Template.PullSecretRef in the ClusterInstance namespace but returns the source Secret name without copying it to the target namespace. The default-secret path does copy the Secret. HyperShift then passes the returned name to a HostedCluster in the clusters namespace.

An explicit pull Secret can therefore pass validation but be unavailable to the HostedCluster. A same-name Secret in the target namespace could also provide unintended credentials.

References

• internal/controller/clusterinstance_controller.go:336-341
• internal/controller/clusterinstance_controller.go:514-527
• internal/controller/clusterinstance_hypershift.go:277-284

Suggested direction

Give the resolver one contract: always return a Secret name that exists in the target namespace. Copy explicit Secrets when source and target namespaces differ, and align API documentation with this behavior.

Tests

Add HyperShift provisioning coverage where the explicit pull Secret exists only in the ClusterInstance namespace.