Refactor: split downstream ProviderConfig creation out of remotecluster reconciler

[patrick-hermann-sva]

Problem

internal/controller/remotecluster/remotecluster.go is doing too much: connector wiring, secret resolution, git+sops orchestration, and creation of downstream ProviderConfigs for provider-kubernetes / provider-helm / argocd-cluster-secret (:576-613, plus surrounding ~300 lines of create/update/observe).

Impact

• The reconciler file is hard to navigate and test.
• Adding a new downstream target (e.g. a different GitOps tool) requires editing the main reconcile flow.

Suggested fix

Extract downstream provisioning into a sibling package, e.g. internal/downstream/, with an interface:

type Target interface {
    Name() string
    Ensure(ctx context.Context, rc *v1alpha1.RemoteCluster, secretRef corev1.SecretReference) error
    Delete(ctx context.Context, rc *v1alpha1.RemoteCluster) error
}

Register kubernetes, helm, argocd as implementations. The reconciler becomes a thin orchestrator over a slice of Targets.

Files

• internal/controller/remotecluster/remotecluster.go:576-613 and surrounding reconcile flow