🐛 use DeleteCompletedJobs to preserve active scans during CronJob updates

[chris-rock]

Summary

• Replaces DeleteAllOf with DeleteCompletedJobs in all 4 CronJob update paths (k8s_scan local, k8s_scan external, container_image, nodes)
• Running scan jobs are no longer killed when a CronJob spec changes; only completed/failed jobs are cleaned up
• This wires up the DeleteCompletedJobs utility added in 🐛 preserve active jobs when cleaning up completed scan jobs #1377, which was previously unused in production code

Context

When the operator reconciles a CronJob spec change (e.g. new image, new config), it needs to clean up old Jobs since they won't pick up the new spec. Previously this used DeleteAllOf which killed all Jobs including actively running scans. This was disruptive for long-running scans.

The DeleteCompletedJobs function from #1377 already handles this correctly — it skips Jobs with Status.Active > 0 and only deletes completed/failed ones. Active scans finish naturally with the old config, and the next scheduled run picks up the new spec.

Test plan

• All unit tests pass (make test)
• Go linting passes (make lint)
• Actions linting passes (make lint/actions)
• Verify running scans are not interrupted when CronJob spec changes
• Verify completed jobs are still cleaned up on spec change

🤖 Generated with Claude Code

[github-actions]

Test Results

  5 files  +  3   41 suites  +39   32m 49s ⏱️ + 32m 26s
301 tests +299  301 ✅ +301  0 💤  - 1  0 ❌  - 1 
320 runs  +316  318 ✅ +318  2 💤 ±0  0 ❌  - 2 

Results for commit bb58a54. ± Comparison against base commit 637c4fa.