Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix: correct RDS Valkey webhook registration and failover defaults

Two bugs in the RDS Valkey admission webhook:

1. Webhook annotations referenced the wrong API group (rds.inst.buf.red
   instead of rds.valkey.buf.red), causing both the mutating and validating
   webhooks to never fire for Valkey CR operations. This meant the sentinel
   access serviceType was never propagated from spec.access.serviceType to
   spec.sentinel.access.serviceType, resulting in sentinel services always
   being ClusterIP even when NodePort was requested.

2. For ValkeyFailover arch, spec.replicas.shards was only defaulted to 1
   when spec.replicas was nil. If the user provided a Replicas object with
   only ReplicasOfShard set, Shards defaulted to 0 and the validating webhook
   would reject the CR. Fixed by always enforcing Shards=1 for failover,
   matching the existing ValkeyReplica behavior.