[P0] Replace hand-rolled ci-test.yml with the template's ci-integration stage

[jacaudi]

Rewritten. This issue originally proposed repairing the dorny/test-reporter configuration in ci-test.yml. That premise was wrong. jacaudi/template — the canonical copier template for this fleet's pipeline — uses no test reporter at all, so the fix is to adopt the template's stage rather than repair a hand-rolled one. The original symptom and the two real defects are preserved below for the record.

Symptom

The test job introduced by #39 fails at the Test report step:

Error: Input variable 'reporter' is set to invalid value 'golang-json'

The tests themselves are fine

Verified locally on the #39 branch with envtest:

ok  github.com/.../internal/controller  77.0s
ok  github.com/.../internal/ipam         0.3s
ok  github.com/.../internal/iptables     1.0s

CI also logged generated files match the types, so the codegen drift gate passed too.

Two real defects, both dissolved by adopting the template

1. A reporter failure masks the test result. Fail if tests failed is the step that actually inspects test-report.json for "Action":"fail", and it is skipped once Test report errors. Today a genuinely broken test and a passing one both produce a red ci for the same reason — which defeats the continue-on-error + explicit-gate design.

2. The declared permissions could not have worked anyway. ci-test.yml declares permissions: contents: read, and the run log confirms the job received only Contents: read / Metadata: read. dorny/test-reporter publishes a check run and needs checks: write. Even a valid reporter value would have failed.

The actual resolution

Replace the hand-rolled ci-test.yml with the template's ci-integration.yml (examples/operator-envtest), which has no reporter, no continue-on-error, and therefore neither defect:

- name: go test (envtest)
  run: go test ./... -race -tags=integration

go test exits non-zero on failure and the step fails. That is the whole gate.

Three things to reconcile while adopting it, none blocking:

• envtest version. The template pins 1.34.x and installs setup-envtest from controller-runtime v0.22.1; this repo is on controller-runtime v0.18.5 / envtest 1.30.0. Keep the repo's versions until the Kubernetes stack upgrade (the follow-up named in [P0] Bump vulnerable transitive dependencies blocking the lint gate #40) lands, rather than mixing a v0.22 tool against v0.18 code.
• -race. This repo has never run its tests with the race detector. Expect this to surface findings on first run; they are real and worth fixing, but they are new work rather than a regression.
• -tags=integration. The template's stage builds with that tag; this repo's envtest suite carries no build tag. Either add the tag to the suite or drop it from the stage — decide deliberately, because getting it wrong means the stage compiles and runs zero tests while reporting success.

Acceptance criteria

• ci-test.yml replaced by the template's ci-integration.yml
• test stage green on a branch with passing tests
• test stage red on a branch with a deliberately failing test — verified, not assumed
• The stage demonstrably runs a non-zero number of tests (guards the -tags trap)
• Declared permissions match what the steps actually need

Part of the CI alignment onto jacaudi/template. Blocks #37.

[jacaudi]

Done in #43 (merged a4c7b78), together with the test-tier split that landed in #42.

The hand-rolled ci-test.yml is gone; ci-integration.yml from examples/operator-envtest replaces it, with no reporter, no continue-on-error, and go test as the whole gate. Both defects this issue named dissolve with it — there is no reporter step left to mask a failure, and no checks: write needed.

All three reconciliations were handled, and the first turned out to be worse than described:

• envtest version — kept at 1.30.0 as the issue asked. But the template's setup-envtest@v0.22.1 pin does not merely mismatch this repo, it does not resolve at all: tools/setup-envtest is a separate Go module whose only released tags are v0.24.0/v0.24.1, so a controller-runtime version is never valid for it. Pinned v0.24.1 and corrected the renovate annotation, which named the wrong module. Filed upstream as ci-integration.yml: setup-envtest pin does not resolve, breaking the envtest stage in every consumer template#1.
• -race — enabled, and it surfaced no findings.
• -tags=integration — the trap this issue warned about was checked rather than assumed, with go test -list '.*': the tag selects internal/controller, -tags=e2e selects internal/it, and untagged selects neither. On the runner the stage took 79s, the known envtest signature, rather than passing in seconds having run nothing.

One thing this issue did not anticipate: the old pull-request-workflow.yaml also carried a kind-based e2e job, and the template models no e2e stage, so adopting it drops that tier. Tracked separately rather than folded in here.