fix: clarify SPIRE warning message to avoid confusion (#505)

The existing warning 'SPIRE not detected for mTLS-enabled workload' is
confusing because:

1. SPIRE may be running (via Helm) but not detected by this check
2. JWT-SVID authentication works fine despite this warning
3. The check only looks for socket volumes in the pod spec

This commit clarifies that:
- The check is specific to X.509-SVID based mTLS
- JWT-SVID authentication is unaffected
- The message explains what's actually being checked

Fixes rossoctl/rossoctl#2361

Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

operator/internal/controller/agentruntime_controller.go

@@ -854,7 +854,11 @@ func (r *AgentRuntimeReconciler) evaluateMTLSReady(ctx context.Context, rt *agen
 			r.Recorder.Eventf(rt, nil, corev1.EventTypeWarning, "SPIREUnavailable",
 				"MTLSReadyCheck", msg)
 		}
-		logger.Info("SPIRE not detected for mTLS-enabled workload",
+		// This check only verifies X.509-SVID volumes for mTLS certificate management.
+		// This is expected with Helm-managed SPIRE deployments where volumes aren't
+		// pre-injected. Other SPIRE features like SPIFFE auth (JWT-SVID) still work
+		// as long as SPIRE is installed and the feature is enabled.
+		logger.Info("SPIRE socket volumes not detected (X.509-SVID mTLS unavailable)",
 			"workload", rt.Spec.TargetRef.Name, "mtlsMode", mtlsMode)
 	}
 }