refactor(controller): extract shared mirror-deletion and naming helpers

Replace the triplicated ownership-verified delete guard with deleteOwnedMirror, and hand-built controller-name strings with gvkControllerName. Use constants.Domain/ControllerName over magic strings and maps.Copy/Clone for plain copy loops. Behaviour-preserving; tests green.

pkg/controller/mirror_deletion.go

@@ -0,0 +1,65 @@
+// Package controller implements the kubemirror reconciliation logic.
+package controller
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// mirrorDeletionOutcome describes the result of an ownership-verified mirror
+// deletion attempt.
+type mirrorDeletionOutcome int
+
+const (
+	// mirrorAbsent means no resource exists at the requested namespace/name.
+	mirrorAbsent mirrorDeletionOutcome = iota
+	// mirrorNotOwned means a resource exists but is not a kubemirror-managed
+	// mirror of the given source, so it was left untouched.
+	mirrorNotOwned
+	// mirrorDeleted means an owned mirror was found and deleted.
+	mirrorDeleted
+)
+
+// deleteOwnedMirror deletes the mirror at gvk/ns/name only if it is managed by
+// kubemirror AND its source reference matches srcNs/srcName. This ownership
+// guard is the single safety gate that prevents deleting an unrelated resource
+// that merely shares the same name. All mirror-cleanup paths route through here
+// so the guard cannot be forgotten in one place and drift in another.
+//
+// A NotFound on delete is treated as success (the mirror is already gone).
+func deleteOwnedMirror(
+	ctx context.Context,
+	c client.Client,
+	gvk schema.GroupVersionKind,
+	ns, name, srcNs, srcName string,
+) (mirrorDeletionOutcome, error) {
+	mirror := &unstructured.Unstructured{}
+	mirror.SetGroupVersionKind(gvk)
+
+	if err := c.Get(ctx, client.ObjectKey{Namespace: ns, Name: name}, mirror); err != nil {
+		if errors.IsNotFound(err) {
+			return mirrorAbsent, nil
+		}
+		return mirrorAbsent, err
+	}
+
+	// Verify this is actually our mirror (not someone else's resource with the same name).
+	if !IsManagedByUs(mirror) {
+		return mirrorNotOwned, nil
+	}
+
+	// Verify this mirror points to our source.
+	refNs, refName, _, found := GetSourceReference(mirror)
+	if !found || refNs != srcNs || refName != srcName {
+		return mirrorNotOwned, nil
+	}
+
+	if err := c.Delete(ctx, mirror); err != nil && !errors.IsNotFound(err) {
+		return mirrorNotOwned, err
+	}
+	return mirrorDeleted, nil
+}