Report Gateway and GatewayClass status conditions

[Shine-neko]

Summary

Sōzune watched Gateway API Gateway and GatewayClass resources but never reported status back onto them, so kubectl get gateway/gatewayclass showed Unknown conditions even when sōzune was serving their routes. An operator had no way to confirm a Gateway was accepted without reading sōzune's logs. This adds the standard status conditions the Gateway API spec expects, and fixes a related acceptance race the new status assertions surfaced.

What changed

• Status conditions — sōzune now writes status.conditions[] on the resources it owns:
  • GatewayClass — Accepted=True on a class whose controllerName is kemeter.io/sozune.
  • Gateway — Accepted=True and Programmed=True on every Gateway pointing at such a class (acceptance and programming are the same instant for sōzune, so both flip together).
  • Resources owned by another controller are left untouched, per spec.
• Off the watcher hot-path — status writes go through a dedicated run_gateway_status_writer task fed by an mpsc channel, mirroring the existing HTTPRoute status writer. Watchers only try_send, never block their event loop on an apiserver PATCH round-trip.
• Acceptance race fix — a Gateway created before its GatewayClass came into scope stayed rejected until it was next edited, because the Gateway watcher never saw a fresh event for it. When a class's acceptance changes, sōzune now re-lists Gateways and re-runs them through the scope, so their routes activate immediately (and their status is written).
• Merge semantics — merge_conditions replaces only the condition types sōzune owns and preserves foreign ones, ignoring last_transition_time so a periodic re-evaluation doesn't hammer the apiserver.
• RBAC — adds gateways/status and gatewayclasses/status patch verbs (e2e deploy manifest + docs).

Tests

• 7 new unit tests covering the condition builders, observedGeneration, and the merge/dedup logic (foreign-type preservation, timestamp-only no-op, status flip).
• e2e (02-gateway.sh): asserts GatewayClass Accepted=True and Gateway Accepted=True/Programmed=True. Verified end-to-end on kind against a local image build: 28 passed, 0 failed.
• cargo fmt --check, clippy clean; full unit suite 679 passed.

Docs

New Gateway and GatewayClass status-condition tables in the Kubernetes provider docs, RBAC updated.