fix(controller): forward APIReader+CircuitBreaker through NamespaceReconciler

H4: NamespaceReconciler.reconcileMirror builds an ad-hoc SourceReconciler
to delegate mirror creation. The previous version left APIReader and
CircuitBreaker as nil, which silently disabled freshness verification
on the namespace-driven path (a label change to a target namespace
would mirror cached, possibly stale source data) and bypassed circuit
breaker accounting for those reconciles.

Construction extracted into newSourceReconciler so the forwarding is
covered by a unit test that pins both fields by identity.

cmd/kubemirror/main.go

@@ -429,6 +429,7 @@ func main() {
 		NamespaceLister: namespaceLister,
 		ResourceTypes:   cfg.MirroredResourceTypes,
 		APIReader:       mgr.GetAPIReader(), // Direct API reader for fresh namespace lookups
+		CircuitBreaker:  cb,                 // Forwarded into reconcileMirror so namespace-driven mirrors share failure throttling
 	}
 
 	if err = namespaceReconciler.SetupWithManager(mgr); err != nil {