[ARO-26611] Add workaround controller for copyfail to mitigate control plane nodes

[hawkowl]

Which issue this PR addresses:

Fixes ARO-26611

What this PR does / why we need it:

Adds a workaround controller to add a mitigation for copyfail to control planes, exempting FIPS ones since they can't be mitigated via this method

Test plan for issue:

Manual testing

[Copilot]

Pull request overview

Adds a new “copy fail” mitigation workaround intended to protect control plane nodes (skipping FIPS clusters), and updates the workaround controller interface to support context + error-returning requirement checks.

Changes:

• Extend Workaround.IsRequired to accept context.Context and return (bool, error); update controller logic and mocks accordingly.
• Introduce aro.workaround.copyfail.enabled operator flag (default enabled).
• Add copyfailworkaround implementation (MachineConfig applying initcall_blacklist=algif_aead_init) plus unit tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/util/mocks/operator/controllers/workaround/workaround.go	Updates gomock stub to match new IsRequired(ctx, ...) (bool, error) signature.
pkg/operator/flags.go	Adds CopyFailWorkaroundEnabled flag and defaults it to true.
pkg/operator/controllers/workaround/workaround_controller_test.go	Updates gomock call arity for IsRequired (now takes ctx), but needs return-value fixes.
pkg/operator/controllers/workaround/workaround_controller.go	Updates reconcile loop to call new IsRequired signature and aggregate errors.
pkg/operator/controllers/workaround/workaround.go	Updates the Workaround interface signature for IsRequired.
pkg/operator/controllers/workaround/systemreserved.go	Updates systemreserved workaround to new IsRequired signature.
pkg/operator/controllers/workaround/copyfailworkaround.go	Adds the new copyfail workaround implementation using a master MachineConfig.
pkg/operator/controllers/workaround/copyfailworkaround_test.go	Adds unit tests for the copyfail workaround enablement/FIPS/error behaviors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yjst2012]

LGTM, thanks for the idea and quick implementation, appreciate it!