perf(controller): stop per-target apiserver reads in mirror reconcile

The mirror reconcile path issued one direct apiserver GET per target
namespace on every pass. With N sources and M target namespaces each
resync produced N*M GET requests. On a 65-namespace cluster this
generated 63 GET/s and overloaded one control-plane node.

Changes:
- reconcileMirror now trusts the informer cache. Content drift is
  detected via the source hash annotation. A stale resourceVersion
  makes Update return a conflict, which requeues the source.
- The verify-source-freshness flag now defaults to false. The Helm
  chart passes the value explicitly, so the chart default of false
  matches the binary behaviour.
- Reconcile performs one namespace LIST per pass. Target resolution
  and orphan cleanup share the result.
- Add load regression tests that count direct API reads in the
  reconcile hot path.

pkg/controller/namespace_reconciler.go

@@ -196,8 +196,9 @@ func (r *NamespaceReconciler) reconcileResourceType(ctx context.Context, rt conf
 // (pattern parsing/validation, namespace listing, max-targets clamping) lives in
 // exactly one place, mirroring the reconcileMirror delegation below.
 func (r *NamespaceReconciler) resolveTargetNamespaces(ctx context.Context, source *unstructured.Unstructured) ([]string, error) {
-	return r.newSourceReconciler(source.GroupVersionKind()).
+	targets, _, err := r.newSourceReconciler(source.GroupVersionKind()).
 		resolveTargetNamespaces(ctx, source)
+	return targets, err
 }
 
 // reconcileMirror creates or updates a mirror in the target namespace by