Fix leader-election RBAC, Go version drift, PVC churn, cron names, apply order

Addresses PR review + acceptance findings:

- Add leader-election RBAC: namespaced Role (coordination leases +
  events) and RoleBinding to the operator ServiceAccount, so controllers
  actually start under --leader-elect instead of looping on "leases
  forbidden". Verified in a kind cluster: lease acquired, both
  controllers start workers.
- Align Go versions: bump Dockerfile.operator to golang:1.26-alpine and
  CI images to golang:1.26 to match go.mod (go 1.26.5); set
  GOTOOLCHAIN=local so the image build stays hermetic (no toolchain
  download).
- PVC controller: add an annotation predicate so only PVCs carrying (or
  transitioning off of) backups.unkin.net/schedule enqueue, eliminating
  reconcile churn from unannotated PVCs while keeping the teardown path.
- Cron validator: accept alphabetic month/day-of-week names (MON, JAN,
  MON-FRI) that k8up and CNPG's robfig/cron accept, still rejecting
  unknown names; add unit tests for both mapping paths.
- Deploy ordering: extract the Namespace into its own manifest and add a
  config/kustomization.yaml so `kubectl apply -k config` creates the
  namespace first; document it in the README.
- Note the credential-less push precedent (jellyfin-ha) in docker.yaml.

internal/controller/pvc_controller.go

@@ -9,9 +9,12 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
 // PVCReconciler backs up annotated PersistentVolumeClaims by provisioning an S3
@@ -140,9 +143,28 @@ func secretKeyRef(name, key string) *corev1.SecretKeySelector {
 	}
 }
 
+// hasScheduleAnnotation reports whether an object carries the schedule
+// annotation that marks it for management.
+func hasScheduleAnnotation(o client.Object) bool {
+	_, ok := o.GetAnnotations()[annSchedule]
+	return ok
+}
+
+// schedulePredicate limits reconciles to PVCs that carry (or, on update, used to
+// carry) the schedule annotation, so unannotated PVCs no longer churn the queue
+// on every resync while the annotation-removed teardown path still fires.
+var schedulePredicate = predicate.Funcs{
+	CreateFunc:  func(e event.CreateEvent) bool { return hasScheduleAnnotation(e.Object) },
+	DeleteFunc:  func(e event.DeleteEvent) bool { return hasScheduleAnnotation(e.Object) },
+	GenericFunc: func(e event.GenericEvent) bool { return hasScheduleAnnotation(e.Object) },
+	UpdateFunc: func(e event.UpdateEvent) bool {
+		return hasScheduleAnnotation(e.ObjectOld) || hasScheduleAnnotation(e.ObjectNew)
+	},
+}
+
 func (r *PVCReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
-		For(&corev1.PersistentVolumeClaim{}).
+		For(&corev1.PersistentVolumeClaim{}, builder.WithPredicates(schedulePredicate)).
 		Owns(&k8upv1.Schedule{}).
 		Named("pvc-autobackup").
 		Complete(r)