fix(controller): canonicalise peer order in the agent state

[mxhob1]

Follow-up to #15. Manager-side counterpart: stops the pointless state pushes at the source.

Why

The reconciler rewrites the Wireguard Secret whenever the marshalled state differs from what's stored, and every rewrite patches wgConfigLastUpdated on every tenant's WG pod. filteredPeers is built by iterating peers.Items from a controller-runtime cached r.List, which returns informer-map iteration order — so it reshuffles between reconciles even when no peer changed, and the reshuffle alone makes the bytes differ.

Measured on managed-superopti: 340 Updating secret with new config in 37h (~9/h) against 40 peers whose set never changed. Per-tenant counts track peer count (pivit 90, internal 82, optimised 80, wavesquared 51, indigo 47, legion 12, edgecentres 4).

Scope, narrowed by evidence

I originally intended to also strip volatile peer metadata (resourceVersion, generation, managedFields) from the marshalled state. Re-checking 8 captured state.json snapshots says that isn't warranted:

normalisation	distinct hashes across 8 pushes
none	8
sort peers by name only	1
sort + strip metadata	1

Sorting alone accounts for all of it — resourceVersion/generation/managedFields were identical across every push. Narrowing the state format the agent consumes would be risk for no measured benefit, so this change is the sort only.

Change

Extract stateForAgent() (pure refactor of two identical construction sites) and sort a copy of the peers by name — unique within a namespace and always set, so a total order. Copying keeps the caller's slice untouched.

The manager only needs a stable order; the agent re-sorts on (Address, AddressV6, Name) for rendering regardless.

Tests

• TestStateForAgentIsByteIdenticalRegardlessOfPeerOrder — asserts the invariant that actually decides whether the Secret is rewritten. Watched failing: marshalled state depends on peer list order.
• TestStateForAgentDoesNotReorderCallerPeers — guards against sorting in place.

make test green, including the internal/controller envtest suite (85s, 75.8% coverage).

Not urgent

#15 already stopped the harm — the agent skips the restore when the ruleset is unchanged, so these pushes cost nothing but wasted work. This is cleanup, and is deliberately not being deployed yet: containers stays pinned at 0ce1117.

🤖 Generated with Claude Code