OSAC-4075: Add duplicate-job guards to bare-metal deprovisioning

[coderabbitai]

Summary

Add duplicate-job guards to deprovisioning in bare-metal-fulfillment-operator.

BareMetalInstanceReconciler and BareMetalPoolReconciler currently pass nil for checkAPIServer and statusFlush to provisioning.RunDeprovisioningLifecycle. A stale informer cache can therefore allow a rapid reconcile to create a duplicate external deprovision job.

Required changes

• Add an APIReader dependency to BareMetalInstanceReconciler and BareMetalPoolReconciler.
• Wire APIReader through both reconciler constructors and SetupWithManager call sites.
• In both deprovisioning paths, pass a direct API-server check for non-terminal deprovision jobs.
• In both deprovisioning paths, pass a status-flush callback that persists status with conflict retry behavior consistent with the OSAC operator controllers.
• Add focused tests for stale-cache detection and duplicate-job prevention in both controller paths.

Affected areas

• bare-metal-fulfillment-operator/internal/controller/baremetalinstance_controller.go
• bare-metal-fulfillment-operator/internal/controller/baremetalpool_controller.go
• Reconciler construction and manager setup for the bare-metal fulfillment operator
• Controller tests for bare-metal instance and bare-metal pool deprovisioning

Acceptance criteria

• Neither reconciler passes nil for checkAPIServer or statusFlush.
• Each reconciler uses a direct API-server read to detect a non-terminal deprovision job before creating another job.
• Each reconciler persists deprovisioning status safely when the lifecycle creates or updates job state.
• Tests prove that stale cached status does not trigger duplicate deprovision jobs.
• Existing deprovisioning behavior remains unchanged when no active job exists.

Backlinks

• Pull request: OSAC-4031: fix race condition in RunDeprovisioningLifecycle #335
• Review comment: OSAC-4031: fix race condition in RunDeprovisioningLifecycle #335 (comment)

Requested by: @alosadagrande