fix: expose rendered binding template internally

[onutc]

Summary

• documents the generic binding target reconciliation contract
• exposes rendered binding template details in the internal binding response so deployments can compare saved target state with live SpritzBinding state
• adds a regression test covering resolved service account and agent ref visibility from the internal binding read response

Tests

• go test ./... (api)
• go test ./... (operator)
• codex review --base main

Staging

Pending merge and staging deployment verification.

[gitrank-connector]

👍 GitRank PR Analysis

Score: 20 points

Metric	Value
Component	Other (1× multiplier)
Severity	P2 - Medium (20 base pts)
Final Score	20 × 1 = 20

Eligibility Checks

Check	Status
Issue/Bug Fix	✅
Fix Implementation	✅
PR Documented	✅
Tests	✅
Lines Within Limit	✅

Impact Summary

This PR exposes rendered binding template details in the internal binding API response, enabling deployments to detect and repair target mismatches between saved desired state and live SpritzBinding state. It includes comprehensive documentation of the binding target reconciliation contract and adds regression tests verifying that resolved service account and agent references are visible in the internal binding read response. The change prevents a correctness bug where Spritz could route traffic to the wrong runtime after a target change.

Analysis Details

Component Classification: This PR affects internal API response structures and binding reconciliation logic, which doesn't fit cleanly into a specific domain component. It's classified as OTHER since it's a cross-cutting internal API enhancement.

Severity Justification: This is a P2 (Medium) severity fix. It addresses a correctness bug where stale runtime state could silently serve traffic after target changes, but includes a workaround (manual repair) and doesn't cause immediate service outage. The fix is preventative and enables proper state reconciliation.

Eligibility Notes: Issue: True - PR explicitly fixes a correctness bug (stale runtime state serving traffic). Fix Implementation: True - code changes expose template details and add test coverage as described. PR Linked: True - comprehensive description with summary, tests, and staging notes. Tests: True - includes regression test in internal_bindings_test.go with new helper function. Tests Required: True - this is a bug fix in business logic (binding reconciliation) and API contract change, both requiring test coverage to prevent regression.

---

Analyzed by GitRank 🤖