service: isolate gateway labels per object during reconciliation

[ShubhamMishra99]

Description

Fixes hidden shared-state mutation during full-mesh gateway reconciliation by isolating gateway label maps per generated object.

Currently, WorkerSliceGatewayService creates full-mesh gateway pairs for every cluster combination during SliceConfig reconciliation. While building gateway resources, the base labels map was being mutated in-place and reused across gateway objects.

Because Go maps are reference types, this can introduce unintended label aliasing and hidden mutable shared state across generated topology objects.

Changes

• Copy owner labels per gateway object in buildMinimumGateway
• Apply directional labels (worker-cluster, remote-cluster) on isolated copies
• Assign object-local label maps to ObjectMeta.Labels
• Add regression coverage validating label isolation behavior

Why this matters

This change improves reconciliation safety and topology object correctness without changing external API behavior or full-mesh semantics.

It also reduces hidden coupling in gateway generation paths and makes future topology abstraction work safer as partial-mesh / hub-and-spoke support evolves.

Fixes #

---

How Has This Been Tested?

Validated using targeted gateway service test execution.

Added regression test

• TestBuildMinimumGateway_LabelsAreIsolatedPerGateway

Verified behavior

• directional labels remain correct for both gateway directions
• original owner label map remains unchanged
• gateway objects do not share mutated label state

Test command

ALLURE_RESULTS_PATH=/tmp/allure-results go test worker_slice_gateway_service.go worker_slice_gateway_service_test.go worker_slice_config_service.go job_service.go secret_service.go kube_slice_resource_names.go service_helper.go -run "TestWorkerSliceGatewaySuite/TestBuildMinimumGateway_LabelsAreIsolatedPerGateway" -count=1

---

Checklist

• The title of the PR states what changed
• I have performed a self-review of my own code
• I have added the required unit test cases
• This PR does not introduce breaking API changes

---

Does this PR introduce a breaking change for other components like worker-operator?

No.

This PR only hardens internal gateway reconciliation behavior by isolating per-object label state. It does not modify APIs, CRDs, topology semantics, or worker-operator contracts.

[mdryaan]

Hi @ShubhamMishra99, this looks like it covers the same fix as #326 which was opened 2 weeks ago, both clone the label map in buildMinimumGateway to prevent shared mutation. Worth coordinating with that PR to avoid duplicate work.

[ShubhamMishra99]

Hii @mdryaan
Thanks for the observation, @mdryaan. While both PRs address the same root cause (shared map mutation),
the approach in #388 is intentionally broader.

Instead of only cloning the incoming map, this PR introduces an explicit gateway-local label map that is assigned to the generated object, making label ownership and mutation boundaries clearer during reconciliation. In addition, it adds a regression test covering both gateway directions and verifies that the original owner labels remain unchanged.

So there is functional overlap, but #388 also focuses on maintainability, explicit object isolation, and long-term regression protection.

Hope you will understand!