Addresses PR review + acceptance findings:
- Add leader-election RBAC: namespaced Role (coordination leases +
events) and RoleBinding to the operator ServiceAccount, so controllers
actually start under --leader-elect instead of looping on "leases
forbidden". Verified in a kind cluster: lease acquired, both
controllers start workers.
- Align Go versions: bump Dockerfile.operator to golang:1.26-alpine and
CI images to golang:1.26 to match go.mod (go 1.26.5); set
GOTOOLCHAIN=local so the image build stays hermetic (no toolchain
download).
- PVC controller: add an annotation predicate so only PVCs carrying (or
transitioning off of) backups.unkin.net/schedule enqueue, eliminating
reconcile churn from unannotated PVCs while keeping the teardown path.
- Cron validator: accept alphabetic month/day-of-week names (MON, JAN,
MON-FRI) that k8up and CNPG's robfig/cron accept, still rejecting
unknown names; add unit tests for both mapping paths.
- Deploy ordering: extract the Namespace into its own manifest and add a
config/kustomization.yaml so `kubectl apply -k config` creates the
namespace first; document it in the README.
- Note the credential-less push precedent (jellyfin-ha) in docker.yaml.
