perf(controller): repair mirror drift from watch events instead of resync

Mirror update events were filtered out, so an in-place edit of a
mirrored copy was invisible to the controller. The periodic resync did
not catch it either: NeedsSync only compares the source content hash
with the recorded annotation, and tampered mirror data leaves both
unchanged.

Changes:
- The mirror watch now passes real update events (resourceVersion
  changed, object is a managed mirror) and maps them to the source.
  Informer resync replays keep an unchanged resourceVersion and stay
  filtered.
- reconcileMirror detects in-place drift by rebuilding the expected
  mirror in memory and comparing content hashes. Metadata differences
  never count as drift, so the controller's own writes converge in one
  no-op pass.
- The resync-period default moves from 10m to 1h. Watches now cover
  source changes, mirror deletion, mirror drift, and namespace changes,
  so the resync is only a safety net for missed watch events. The chart
  default moves with it.
- Add predicate and tamper-repair regression tests; drift repair is
  verified to make no direct apiserver reads.

cmd/kubemirror/main.go

@@ -108,8 +108,10 @@ func main() {
 		"QPS rate limit for API server requests.")
 	flag.IntVar(&rateLimitBurst, "rate-limit-burst", 100,
 		"Burst limit for API server requests.")
-	flag.DurationVar(&resyncPeriod, "resync-period", 10*time.Minute,
-		"Period for resyncing all resources (catches updates missed due to informer cache delays).")
+	flag.DurationVar(&resyncPeriod, "resync-period", time.Hour,
+		"Period for the full informer resync. Sources, mirrors, and namespaces "+
+			"are watched, and mirror drift is repaired event-driven, so the resync "+
+			"is only a safety net for missed watch events.")
 	flag.BoolVar(&verifySourceFreshness, "verify-source-freshness", false,
 		"Verify source resource freshness by comparing cache with direct API read. "+
 			"Converges a few seconds faster when the informer cache lags behind watch "+