feat: domain.Request/Result, requeue:, failPolicy:, ToClient cache

[iAlexeze]

Phase 2

This PR follows #264 (controller-runtime compat) and completes the picture.

The signature change that unlocks everything

domain.Reconciler used to be:

Reconcile(ctx context.Context, key string) error

It is now:

Reconcile(ctx context.Context, req Request) (Result, error)

Result.RequeueAfter now flows from every reconciler — typed or declarative — into the workqueue. A cert-rotation operator written entirely in YAML can say:

 requeue:
   after: "{{ timeUntil .status.certExpiry }}"` 

and each CR schedules its own next reconcile from its own state. The same path that carries ctrl.Result.RequeueAfter from a migrated controller-runtime reconciler now carries YAML-declared requeue intent from a declarative operator. One mechanism, two surfaces.

controller-runtime gets cache reads

kubeclient.ToClient(kube) now serves client.Get and client.List from the informer store for any type with a registered informer — the primary CRD and every watch: entry. Types without an informer fall through to a live API call. This restores the caching behaviour that mgr.GetClient() provided before migration, silently and without any change to the reconciler.

New features

• requeue: — per-object, per-state requeue on reconciler.requeue:. Conditional via when:/or:. after: is a template expression with the full post-reconcile resolver.

operatorBox:
  reconciler:
    requeue:
      after: "{{ timeUntil .status.certExpiry }}"   # per-object, from its own state
      when:
        - field: status.phase
          equals: "Active"

• failPolicy: — open (default) or closed on both enqueueGate and reconcileGate. Controls what the gate does when an external: call fails. Validator warns when external: is declared without an explicit policy.

preReconcile:
  reconcileGate:
    failPolicy: closed   # hold back on evaluation failure
    external:
      - name: dep
        url: "{{ .spec.dependencyUrl }}/health"
    when:
      - field: external.dep.status
        equals: "200"

Breaking renames

• anyOf: → or: everywhere in the schema. Reads naturally alongside when:.
• hooks.resources: / constructor.resources: → managedResources: — removes the ambiguity with the watch: block.
• domain.Reconciler interface — all implementors updated.

Documentation updated.