chore: remove unreachable SetupWithManager(secret-only) on SourceReconciler

All registration goes through SetupWithManagerForResourceType (eager and
lazy paths in main.go); the legacy single-resource SetupWithManager and
its corev1 import were dead code that misled readers about how the
controller wires up.

pkg/controller/source_reconciler.go

@@ -8,7 +8,6 @@ import (
 	"slices"
 	"time"
 
-	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -141,9 +140,10 @@ func (r *SourceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 		return ctrl.Result{}, err
 	}
 
+	// sourceObj is just an alias kept for readability when calling code that
+	// expects the metav1.Object interface; both names point at the same value.
 	sourceObj := source
 
-	// Check if this is a mirror resource (shouldn't reconcile mirrors as sources)
 	if IsMirrorResource(sourceObj) {
 		// Silently skip - mirrors reconcile via watch, not as sources
 		return ctrl.Result{}, nil
@@ -679,15 +679,6 @@ func isEnabledForMirroring(obj metav1.Object) bool {
 	return true
 }
 
-// SetupWithManager sets up the controller with the Manager.
-func (r *SourceReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	// Build predicate to only watch resources with enabled label
-	// This reduces API server load by ~90%
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&corev1.Secret{}).
-		Complete(r)
-}
-
 // SetupWithManagerForResourceType sets up a controller for a specific resource type.
 // This allows dynamic controller registration for any discovered resource type.
 func (r *SourceReconciler) SetupWithManagerForResourceType(