feat(runner): add WithCacheByObject for per-object cache namespace scoping

[liangwen12year]

Summary

• Add WithCacheByObject(map[client.Object]cache.ByObject) method to Runner
• Allows downstream consumers to configure per-object cache namespace scoping on the controller-runtime manager
• Entries in ByObject override DefaultNamespaces (set via the NAMESPACE env var) for the specified object types

Motivation

Downstream consumers (e.g. opendatahub-io/ai-gateway-payload-processing) need to scope the Secret informer to specific namespaces for RBAC hardening. Without this, the default cache does a cluster-scoped LIST /api/v1/secrets that requires a ClusterRoleBinding with cluster-wide secrets access. With WithCacheByObject, the Secret informer can be scoped to model namespaces, allowing namespace-scoped RoleBindings instead.

Usage

runner.NewRunner().
    WithCacheByObject(map[client.Object]cache.ByObject{
        &corev1.Secret{}: {
            Namespaces: map[string]cache.Config{
                "model-namespace": {},
            },
        },
    }).
    WithCustomControllers(...).
    Run(ctx)

Changes

• cmd/runner/runner.go: Add cacheByObject field to Runner struct, WithCacheByObject builder method, and wire ByObject into cache.Options in Run()
• cmd/runner/runner_test.go: Unit tests for the new method

Closes #300

🤖 Generated with Claude Code

[github-actions]

🚨 Unsigned commits detected! Please sign your commits.

For instructions on how to set up GPG/SSH signing and verify your commits, please see GitHub Documentation.

[lphiri]

LGTM.
This gives users flexibility to limit service account privileges.