fix: reclaim orphaned Hetzner servers Karpenter has lost track of - #53

Karpenter core's garbage collector runs in one direction only: it deletes
NodeClaims that have no instance. Nothing terminates an instance that has no
NodeClaim, so that direction is the cloud provider's responsibility. Without it
an orphaned server runs and bills forever.

Sweep every two minutes over the servers this installation created, terminating
those Karpenter no longer claims along with the Node object left behind.
Ownership is read from the karpenter.sh/nodeclaim label as well as the NodeClaim
provider ID, so a server whose ID was never recorded is still recognised while
its Create is in flight, and the ownership labels are re-checked here rather
than trusting the caller's list filter.

Grace is counted in consecutive sweeps that found nothing standing in the way of
reclaiming the server -- not sweeps since its NodeClaim went missing, and not
elapsed time. Machine age is the wrong quantity: a server owned for hours would
lose all protection the moment its NodeClaim blipped. Counting observations also
removes any dependence on comparing Hetzner's clock to this pod's. Crucially the
count only advances on sweeps that cleared every guard, so a machine spared for
hours never sits on a spent counter where a single briefly-NotReady kubelet
would destroy it; once sparing stops it must earn a complete fresh window.

The sweep declines to act whenever the state is not clearly an orphan. A node
that is registered and still Ready is left alone, since a lost NodeClaim (a CRD
reinstall, an etcd restore) must never become a fleet-wide termination with no
eviction or drain. Registration is read from karpenter.sh/registered, which
Karpenter stamps itself and treats as the definition of registered; the
unregistered taint is deliberately not used, as it reaches a node only when the
NodePool declares it as a startupTaint. A node the CCM has not yet stamped with
a provider ID is matched by name rather than treated as absent. Provider IDs
mapping to more than one Node are skipped rather than resolved by guessing, and
Node deletes carry a UID precondition so a same-named replacement is never
removed.

Failures never cost the cadence: list errors and undeletable servers are logged,
counted, and stepped over, because returning an error drops RequeueAfter and
ratchets controller-runtime's backoff toward its cap. Sweeps that cannot
complete are recorded as sweep_failed, so a permanently broken sweep is
distinguishable from a cluster that simply has no orphans.

DISABLE_INSTANCE_GARBAGE_COLLECTION pauses the sweep for maintenance that
removes NodeClaims wholesale, without also stopping provisioning and disruption.
An unrecognised value is rejected rather than defaulted: the moment an operator
reaches for this flag is a maintenance window, and a typo failing open would
reap the fleet they were protecting.

The chart already grants node delete, which Karpenter core requires for
termination, so no RBAC change is needed.

CLUSTER_NAME is operator-supplied and nothing enforces uniqueness. Two
clusters sharing one in a single Hetzner project each read the other's servers
as their own. That was harmless while the label only scoped listings; it is not
now that unclaimed servers are deleted, so a copied values.yaml or a blue/green
rebuild could have one cluster terminate another's fleet.

Stamp the UID of the cluster's kube-system namespace on every server created.
It is unique per cluster, stable for the cluster's lifetime, needs no state of
our own, and is readable with the RBAC the chart already grants. Both the
adoption path and the sweep refuse a server whose UID is present and different.

A missing UID is treated as ours: servers created before this change carry
none, and refusing them would strand every pre-existing orphan and break
adoption for machines this cluster really did create. Distinct names therefore
remain the thing to get right for existing fleets; new servers are protected
regardless.

Declining silently would not be enough. A name collision would look exactly
like a cluster with no orphans, and nobody would learn two clusters share a
name until something else broke. The sweep reports each colliding cluster once,
naming both UIDs -- once per cluster rather than once per sweep, so it stays
readable.

Three changes aimed at making this safe to adopt on a fleet nobody has audited.

OBSERVE MODE. This controller deletes machines, and an operator adopting it
could otherwise only learn what it would do to their fleet by letting it do it.
A kill switch is reactive; observe mode is not. It runs every check, emits every
signal, and changes nothing -- not the fleet, not the servers' labels, nothing
outside the cluster. INSTANCE_GARBAGE_COLLECTION_MODE replaces the boolean,
since three states do not fit in one, and an unrecognised value refuses to start
rather than falling back to the mode that deletes.

A STARTUP GRACE. Grace is counted in consecutive sweeps, which a restart or a
leader handover resets -- and the instability that strands servers is exactly
what causes those. A fresh process could otherwise reach the threshold having
watched the cluster for only a few minutes. It must now also have been sweeping
for a full window before it may reclaim anything, so operator instability delays
reclamation rather than either skipping it forever or authorising it on a short
history.

This is what makes in-process counting safe rather than merely simple, and it
follows core: nodeclaim/consistency keeps first-seen times in an in-process
cache and writes nothing durable. Core's durable timeouts hang off status
conditions on objects it owns, never off the cloud resource. An earlier revision
of this branch stored the clock on the Hetzner server itself; it was withdrawn
because it made a safety-critical invariant depend on a remote write that can
fail silently, on a clock written by a process that may be gone, and on state an
operator can edit with one CLI command.

NODE EVENTS. Reclamations are recorded as GarbageCollected, and observe-mode
candidates as WouldGarbageCollect, typed Normal -- reclaiming an orphan is this
controller working, not a fault, and a cluster alerting on Warning events
against Nodes should not page every time the sweep does its job. Most orphans
never registered a Node, so this supplements the log and the metric rather than
replacing them, and the doc comment says so.

Three chart-level holes closed alongside them. The ClusterRole now grants
events.k8s.io, without which the manager's recorder has every event rejected 403
while the README tells operators to validate observe mode by reading them. The
mode is emitted unconditionally rather than through a "with" block that skips
falsy values, so "mode: false" -- the natural typo when migrating from the
boolean this replaces -- reaches the parser and stops the operator instead of
silently defaulting to enabled. And a "fail" guard rejects an upgrade still
carrying the removed "disabled" key, which Helm would otherwise merge while the
sweep ran on a fleet the operator believed was paused.

The clock is injected, matching core, so the startup grace is testable without
reaching into a fake provider.