fix(webhook): reject cluster deletion when ListResources fails (#371)

[Elvand-Lie]

Description

validateClusterInAnySlice in service/cluster_webhook_validation.go (lines 81-106) validates whether a cluster can be safely deleted by checking if it participates in any slice. The function calls util.ListResources at line 84, but both downstream conditionals (lines 98, 102) only execute when err == nil. If the API call fails, control falls through both checks and returns nil - allowing the deletion to proceed despite being unable to verify slice participation.

Changes:

• service/cluster_webhook_validation.go: Add early return with field.InternalError when ListResources fails, following the fail-closed principle for safety-critical validation
• Remove now-redundant err == nil guards from both conditionals since err is guaranteed nil after the early return

Fixes #371

How Has This Been Tested?

• go build ./... passes
• Manual code review: the error path now returns a clear internal error instead of silently allowing deletion

Checklist:

• The title of the PR states what changed and the related issues number (used for the release note).
• Does this PR requires documentation updates?
• I've updated documentation as required by this PR.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have tested it for all user roles.
• I have added all the required unit test cases.

Does this PR introduce a breaking change for other components like worker-operator?

No. This only affects the cluster delete validation webhook. The behavioral change is that cluster deletion is now correctly rejected (fail-closed) during API server instability, instead of being silently allowed.