v0.5.2

Breaking design change vs v0.5.0/v0.5.1

Replaces the finalizer-on-Cluster-CR approach to cleaning up orphan ArgoCD cluster Secrets. Adding our finalizer to a CR we don't own (CAPI's `Cluster`) made this side-mirror controller a chokepoint in the primary cluster lifecycle — if argocd-capi-controller is down or uninstalled, every `Cluster` deletion is wedged until someone patches the finalizer off by hand.

New design

• Event-driven cleanup: when a `Cluster` CR is deleted, the informer still delivers a final reconcile for its key; `Get` returns NotFound, and we derive the Secret name from `req.Name` and delete it. No finalizer, no extra round-trip on every reconcile.
• Startup orphan scan: one-shot list-and-reap at boot. Covers the gap that pure event-driven cleanup leaves when the controller was down at the moment a Cluster was deleted. Uses an uncached direct client, runs before `mgr.Start()`. Not a second controller, not a polling loop.

Upgrade notes

• If you were running v0.5.0/v0.5.1, your existing CAPI `Cluster` CRs have the `argo-capi.cloudnativesolutions.ro/finalizer` finalizer set. v0.5.2 will not remove it (no code path for that). Strip it once:

  ```bash
  kubectl get clusters.cluster.x-k8s.io -A -o name | xargs -I{} \
  kubectl patch {} --type=json -p '[{"op":"remove","path":"/metadata/finalizers"}]'
  ```

  (Or patch only the matching finalizer if you have others.)

• RBAC `clusters/finalizers` is no longer requested.