perf(controller): stop per-target apiserver reads in mirror reconcile

The mirror reconcile path issued one direct apiserver GET per target
namespace on every pass. With N sources and M target namespaces each
resync produced N*M GET requests. On a 65-namespace cluster this
generated 63 GET/s and overloaded one control-plane node.

Changes:
- reconcileMirror now trusts the informer cache. Content drift is
  detected via the source hash annotation. A stale resourceVersion
  makes Update return a conflict, which requeues the source.
- The verify-source-freshness flag now defaults to false. The Helm
  chart passes the value explicitly, so the chart default of false
  matches the binary behaviour.
- Reconcile performs one namespace LIST per pass. Target resolution
  and orphan cleanup share the result.
- Add load regression tests that count direct API reads in the
  reconcile hot path.

charts/kubemirror/templates/deployment.yaml

@@ -43,9 +43,7 @@ spec:
             - --worker-threads={{ .Values.controller.workerThreads }}
             - --rate-limit-qps={{ .Values.controller.rateLimitQPS }}
             - --rate-limit-burst={{ .Values.controller.rateLimitBurst }}
-            {{- if .Values.controller.verifySourceFreshness }}
-            - --verify-source-freshness=true
-            {{- end }}
+            - --verify-source-freshness={{ .Values.controller.verifySourceFreshness }}
             {{- if .Values.controller.lazyWatcherInit }}
             - --lazy-watcher-init=true
             {{- end }}