fix: hash drift, transformer leak guard, prod logger, ctx-aware wait

M7: extractUnstructuredContent only hashed 'spec' when present, dropping
all other top-level content fields. Resources with both spec and data
(or any non-spec content) silently drifted until the next 10m resync.
Now hashes every non-Kubernetes-managed top-level field, matching the
fields updateUnstructuredMirror copies.

M6: when a source has a transform annotation, also hash the source's
labels and annotations (filtered of kubemirror.raczylo.com/* keys to
avoid the controller's own bookkeeping churning the hash). Templates
read these via TransformContext; without this a label change wouldn't
re-render the transformed mirror.

H3: text/template.Execute is not context-aware, so applyTemplateRule's
timeout cancels the select but leaks the executor goroutine. Added a
process-wide semaphore (cap 64) so a runaway template can't spawn an
unbounded number of stuck goroutines on every reconcile.

M4: zap dev mode (DPanic-on-error, console output, stacktraces on
warning) was hardcoded on. Defaulted to production; --zap-devel flag
remains for opt-in.

M5: WaitForInitialDiscovery was anchored on context.Background() with
its own WithTimeout, so SIGTERM during startup couldn't abort the wait.
Now anchors on signalCtx.

cmd/kubemirror/main.go

@@ -115,8 +115,10 @@ func main() {
 	flag.DurationVar(&watcherScanInterval, "watcher-scan-interval", 5*time.Minute,
 		"Interval for scanning cluster to detect new resource types needing watchers (lazy-watcher-init mode only).")
 
+	// Default to production logger (JSON output, no DPanic-on-error). Operators
+	// can opt into development mode via the --zap-devel flag bound below.
 	opts := zap.Options{
-		Development: true,
+		Development: false,
 	}
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
@@ -281,10 +283,9 @@ func main() {
 			os.Exit(1)
 		}
 
-		// Wait for initial discovery with 30s timeout
-		waitCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer cancel()
-		err = discoveryMgr.WaitForInitialDiscovery(waitCtx, 30*time.Second)
+		// Wait for initial discovery with 30s timeout, anchored on the signal
+		// context so SIGTERM during startup actually aborts the wait.
+		err = discoveryMgr.WaitForInitialDiscovery(signalCtx, 30*time.Second)
 		if err != nil {
 			setupLog.Error(err, "timeout waiting for initial resource discovery")
 			os.Exit(1)