fix(conformance): wait for operator Deployment to be Available before specs

The idempotency conformance job ran `make deploy` and immediately executed
the suite. `make deploy` only applies manifests (kustomize build | kubectl
apply --server-side) and returns before the controller-manager Pod has
pulled its image, started, and won leader election. On a cold kind cluster
the first Instance was therefore applied while nothing was reconciling, and
the 2m owned-resource wait expired ("did not have its owned StatefulSet and
Service created within 2m0s").

openclaw-operator's conformance harness does not hit this because it installs
the operator via `helm upgrade --install ... --wait --timeout=10m`, which
blocks until the Deployment is Available. Paperclip's harness had no
equivalent gate.

Fix (mirrors openclaw):
- conformance.yaml: after `make deploy`, block on `kubectl rollout status`
  and `kubectl wait --for=condition=Available` for the controller-manager
  Deployment before running the suite.
- BeforeSuite: wait for the operator Deployment to be Available before any
  Instance is created (defense-in-depth for local runs).
- Bump idempotencyCreateWait 2m -> 5m for headroom on a busy kind cluster.

No conformance assertions are weakened; the gate stays meaningful.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: stubbi

.github/workflows/conformance.yaml

@@ -52,6 +52,19 @@ jobs:
           kind load docker-image paperclip-operator:dev --name paperclip-conformance
       - name: Deploy operator
         run: make deploy IMG=paperclip-operator:dev
+      - name: Wait for operator to be Available
+        # make deploy only applies manifests and returns immediately; the
+        # controller-manager Pod still has to pull its image, start, and win
+        # leader election before it reconciles anything. Block here until the
+        # Deployment is Available so the conformance suite never races the
+        # operator. Mirrors openclaw-operator's `helm install --wait`.
+        run: |
+          kubectl rollout status \
+            deploy -l control-plane=controller-manager \
+            -n paperclip-operator-system --timeout=10m
+          kubectl wait --for=condition=Available \
+            deploy -l control-plane=controller-manager \
+            -n paperclip-operator-system --timeout=5m
       - name: Run idempotency conformance
         env:
           KUBECONFIG: /home/runner/.kube/config

test/conformance/conformance_suite_test.go

@@ -54,6 +54,18 @@ var _ = BeforeSuite(func() {
 	if os.Getenv("KUBECONFIG") == "" {
 		Skip("KUBECONFIG not set: conformance suite requires a live kind cluster with the operator installed")
 	}
+	// `make deploy` only applies manifests and returns immediately. Wait for
+	// the controller-manager Deployment to be Available before any spec creates
+	// an Instance, otherwise the first specs race the operator's image pull,
+	// startup, and leader election and time out waiting for owned resources.
+	// CI also waits via `kubectl rollout status`; this is defense-in-depth for
+	// local runs and mirrors openclaw-operator's helm `--wait` install.
+	// (operatorNamespace() lives in failure_modes_test.go, same package.)
+	opNS := operatorNamespace()
+	out, err := kubectl("wait", "--for=condition=Available",
+		"deployment", "-n", opNS, "-l", "control-plane=controller-manager", "--timeout=5m")
+	Expect(err).ToNot(HaveOccurred(),
+		"operator Deployment in %s never became Available: %s", opNS, out)
 })
 
 var _ = AfterSuite(func() {

test/conformance/idempotency_test.go

@@ -53,8 +53,10 @@ const (
 	idempotencyReconciles = 10
 	// idempotencyCreateWait bounds how long we wait for the operator to create
 	// the instance's owned StatefulSet and Service. This is creation only (no
-	// image pull or app boot), so it settles quickly even on kind.
-	idempotencyCreateWait = 2 * time.Minute
+	// image pull or app boot). The suite already waits for the operator to be
+	// Available before this point, so creation settles quickly; the generous
+	// bound is headroom for a busy kind cluster.
+	idempotencyCreateWait = 5 * time.Minute
 	idempotencyPokeWait   = 15 * time.Second
 )