Enable nvca test execution in the GitHub Actions Bazel matrix

[balajinvda]

Background

The nvca row in .github/workflows/bazel.yml is build-only (tests_skip: true). The inline comment attributes this to TestReconcile_ModelCache (pkg/storage) failing "under envtest >= 1.30" because the test faked a JobSuccessCriteriaMet condition on a NonIndexed Job with no SuccessPolicy, which the apiserver rejects.

Findings

• The failure is specific to k8s 1.30-1.33. On k8s 1.34+ the apiserver relaxed that restriction and instead requires SuccessCriteriaMet before Complete (and rejects CompletionTime without Complete).
• nvca now pins envtest 1.34 (scripts/setup_envtest, K8S_MAJ_MIN_VERSION=1.34) and vendors k8s.io/api v0.35.4.
• The reconciler detects completion via CompletionTime + Succeeded, not the Job conditions.
• A version-adaptive test fix makes pkg/storage pass on both 1.30.3 and 1.34.1 (linked PR).

Ask

Once the test fix lands, enable test execution for the nvca row:

1. Provision envtest assets (KUBEBUILDER_ASSETS) in the matrix job for subtrees that need them. nvca resolves them via scripts/setup_envtest / tools/ci/setup-subtree-envtest. Alternatively scope the run so requires-kubebuilder/external-tagged tests are filtered and the non-envtest unit tests still run.
2. Remove tests_skip: true and the stale ">= 1.30" comment from the nvca matrix row.
3. Confirm bazel test //... passes for nvca on GHA.

Note: the envtest tests are tagged requires-kubebuilder/external; GHA must provide the kube-apiserver + etcd binaries or filter those tests, otherwise they fail on missing KUBEBUILDER_ASSETS.

[balajinvda]

Update from enabling bazel test //... for nvca on PR #239 (job run): bazel build passes and envtest is provisioned in the image (KUBEBUILDER_ASSETS=/usr/local/kubebuilder/bin), but the suite has failures beyond the ModelCache test, so the row stays build-only for now. PR #239 fixes only the ModelCache blocker.

Full backlog to green before flipping tests_skip:

//pkg/operator/reconcile:reconcile_test

• TestGetMiniServiceRBACCmData
• TestGetNetworkPoliciesDataEmptyDDCSIPList
• TestGetNetworkPoliciesDataWithDDCSIPList
• These pass under go test but differ under the Bazel envtest run ("Not equal" on rendered RBAC/NetworkPolicy manifests). Likely a Bazel-vs-go-test environment/serialization difference; test-layer fix.

//pkg/nvca:nvca_test

• TestCreateMiniService_Function, TestCreateMiniService_Task, TestCreateMiniService_TaskDelayedAck - fail with HTTP 412 precondition and "Need to add GVK to test" (scheme/GVK registration missing for the envtest apiserver).
• Test_applyContainerTaskCreationMessage - "Not equal" / "Condition never satisfied".

These are test-layer issues for the nvca team; do not change reconciler logic to satisfy them (per the workflow policy comment). Fix each, then set the nvca row to run tests.