Share the configcheck abnormal-failure retry and cover it - #2313

pkg/resources/syslogng has no test file at all, so its half of this logic
shipped unexercised; covering the shared function covers both callers.

The table states the rule rather than the implementation: an invalid config
is the only failure that is a verdict, and it is the one that leaves the
pod-level Reason empty. stillRunningContainer gets its own table - neither of
its branches had ever executed - including the case it exists for, a native
sidecar still running as an init container after the dry-run has finished.

Signed-off-by: Bence Csati <bence.csati@axoflow.com>

The test for "this extraVolume is only ever realized as a volumeClaimTemplate"
was written inline, so the configcheck pod - which cannot use such a volume -
had no way to ask the question without restating it. Name it next to the
emptiness check it wraps. Behaviour is unchanged; statefulset() branches on
the same condition it did before, negated.

Signed-off-by: Bence Csati <bence.csati@axoflow.com>

…heck pod

A PVC-backed extraVolume is mounted as an empty dir on the configcheck pod,
because the claim behind it only exists as a volumeClaimTemplate on the
StatefulSet. That was the one substitution in this loop that happened
silently: a dry-run that reads the mounted path then fails, and the operator
reports the config invalid with nothing pointing at the swap. Say what was
substituted and how to override it.

The two apply-and-log paths collapse back into one now that the volume to
mount is chosen first, and the condition comes from statefulset(), so the two
cannot disagree about which volumes are template-backed.

Signed-off-by: Bence Csati <bence.csati@axoflow.com>

Each of these was verified to fail when the code it pins is reverted, which
the tests they replace did not:

- the verdict test only covered DeadlineExceeded, the case that already worked
  before the condition was widened to any pod-level Reason, so narrowing it
  back left the suite green. It is now a table over Evicted, NodeAffinity and
  Shutdown as well, plus the empty-Reason case that must stay a verdict.
- the additive test asserted that a pod contains its own entries when no
  override is set, which cannot fail. It compares the whole pod spec instead,
  which is the actual backwards-compatibility claim, and covers an explicitly
  empty override next to the nil one.
- the extraVolume test asserted the volume source only, so dropping half the
  guard - the half that keeps a claim the user brought themselves - stayed
  green. Both claim shapes are now rows, and both assert the mount.

newCheckPodReconciler takes a client so the configCheck tests can use the
fixture the newCheckPod tests use, instead of re-inlining it.

Signed-off-by: Bence Csati <bence.csati@axoflow.com>