fix(bootstrap): make bootstrap Job reconcile idempotent (no immutable-template churn)

[stubbi]

Summary

The admin bootstrap Job (spec.auth.adminUser) was flaky: during live multi-replica verification its pod was killed ~1s after starting by the Job controller itself (SuccessfulDelete immediately after Started container bootstrap), then BackoffLimitExceeded, leaving bootstrapStatus stuck at bootstrap_pending (#83).

Root cause: a Kubernetes Job's pod template is immutable after creation. Two things made the Job controller churn/reap its own pod:

1. The Job was built with explicit pod-template labels but no explicit spec.selector, so the Job controller could adopt a leftover/orphaned pod from a previous bootstrap Job of the same name (e.g. after a manual kubectl delete job + operator recreate) and then delete it.
2. Any reconcile path that re-renders/patches spec.template would force delete/recreate of the running pod.

Changes

• internal/resources/bootstrap.go
  • Set an explicit, unique spec.selector + manualSelector: true keyed to the Job name, plus a matching per-Job pod label (paperclip.ai/bootstrap-job). This Job's pods can never be adopted from a prior/other Job.
  • Stamp a content-hash annotation (paperclip.ai/bootstrap-spec-hash) over the operator-controlled inputs (image, script, admin email, password secret ref).
• internal/controller/instance_controller.go — reconcileBootstrapJob is now strictly create-if-absent:
  • If the Job exists and the hash matches → leave it entirely untouched (never patch spec.template).
  • If the hash differs → delete the stale Job (foreground propagation) and recreate on a later reconcile. Never an in-place template update.

Tests

• New envtest in instance_controller_test.go that reconciles the bootstrap Job N times and asserts the Job is neither updated (same resourceVersion) nor recreated (same UID) — the direct regression for Bootstrap Job (auth.adminUser) is flaky: job controller kills its own pod, backoff-limit exceeded #83. It also asserts the explicit unique selector / manualSelector.
• A second envtest asserts a real config change (admin email) triggers delete + recreate (new UID).

Verification (local)

• make test — green (controller + resources + registry + conformance suites)
• make lint — 0 issues
• hack/sync-chart-crds.sh --check and hack/check-helm-rbac-sync.sh — in sync (no CRD/RBAC changes)
• gosec on changed packages — clean
• Reconcile Guard: no new r.Update calls

Closes #83

🤖 Generated with Claude Code