test(janitor): wait for reconciler to settle before immutability Update

Locally reproduced the CI failure with a focused envtest harness
(creating, snapshotting rv, then doing a stale-rv Update gets the exact
"the object has been modified" 409 error, just like CI). The apiserver
treats the client-supplied resourceVersion as a precondition on Update;
when the reconciler bumps the rv between the test's Get and Update, the
request short-circuits with 409 BEFORE admission webhooks run, so the
test never sees the webhook's "nodeName cannot be changed" rejection.

The sibling lifecycle tests don't hit this because their Setup waits for
NVSentinelOwnershipReleased=True (which parks the dispatcher in the
no-op branch). Mirror that gate here — once Released=True there are no
more reconciler writes to race against, so the fresh Get→Update has a
stable rv and admission gets to run.

Also tightens the Teardown to mirror the other lifecycle tests: drive
finalizer-based cleanup via DeleteAllCRs, plus a Node scrub as
belt-and-suspenders if the finalizer path didn't complete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jtschelling

tests/external_remediation_test.go

@@ -85,12 +85,24 @@ func TestExtRRWebhookRejectsInvalidSpec(t *testing.T) {
 			require.NoError(t, err)
 
 			crName := "extrr-immutable-node"
-			extrr, err := helpers.CreateExtRRCR(ctx, client, crName, nodeName, "immutability-test")
+			_, err = helpers.CreateExtRRCR(ctx, client, crName, nodeName, "immutability-test")
 			require.NoError(t, err, "valid create must be admitted")
 
-			t.Cleanup(func() { _ = client.Resources().Delete(ctx, extrr) })
+			t.Cleanup(func() {
+				_ = helpers.DeleteAllCRs(ctx, t, client, helpers.ExternalRemediationRequestGVK)
+				_ = helpers.ScrubExtRRStateFromNode(ctx, client, nodeName)
+			})
+
+			// Wait for the reconciler to settle (Released=True → branch 6
+			// no-op). Otherwise the apiserver returns 409 conflict on our
+			// Update — the client's resourceVersion becomes a precondition,
+			// and a stale rv short-circuits the request before admission
+			// webhooks run.
+			helpers.WaitForExtRRCondition(ctx, t, client, crName,
+				"NVSentinelOwnershipReleased", "True")
 
-			// Attempt to flip nodeName via update.
+			extrr := &unstructured.Unstructured{}
+			extrr.SetGroupVersionKind(helpers.ExternalRemediationRequestGVK)
 			require.NoError(t, client.Resources().Get(ctx, crName, "", extrr))
 			require.NoError(t, unstructured.SetNestedField(
 				extrr.Object, "different-node", "spec", "healthEvent", "nodeName"))