Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix: address PR review feedback on LocalDNS reconciler

- RBAC: grant get on apps/daemonsets and list on K8s/Cilium/Calico
  network policies so the resolver doesn't get Forbidden in default
  installs.
- localdns.go: treat IsForbidden as non-transient and fail-safe to
  Disabled immediately (no need to burn the retry budget on RBAC).
- localdns.go: invalid Mode now clears LocalDNSState instead of leaving
  a stale Enabled/Disabled value while marking Ready.
- localdns.go: skip the sticky-Enabled status write when (gen, kv) is
  unchanged to avoid churning the API server every reconcile.
- localdns.go: clarify the IsNotFound-on-CRD-list comment.
- tests: add coverage for cilium/calico CRD network policies, the
  Forbidden fail-safe path, and invalid-mode state clearing.
- tests (instancetype): replace lexicographic k8s version comparison
  with semver to match production resolver.
- tests (labels): drop the misleading "Preferred + 1.35 = Enabled" case
  since the reconciler threshold is 1.36 and would resolve Disabled.

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>