fix(nvca): use worker-init transport TLS installer

[mikeyrcamp]

Summary

• Package nvcf-trust-bundle-install in the standard worker-init image while keeping /worker-init as its entrypoint.
• Use the rendered regular init container's image and pull policy for transport-trust installation; remove the separate installer-image configuration and NVCA image binary.
• Move trust-bundle merge and fingerprint logic into the shared Go library, with worker-init ownership of installer tests.
• Fix fix(nvca): address ConfigMap informer follow-ups from #672 #713: ignore ConfigMap informer initial-list Add events, propagate update span context, and wrap sync errors without duplicate logging.

Why

The installer must be published in worker-init before NVCA injects it. Deriving the installer image from the rendered init container keeps the image, pull policy, and rollout metadata aligned. Missing or image-less regular init containers now terminally fail bundle-enabled LLM Pods.

This is stacked on #708 and targets its branch so the prior mount-path work remains separate.

Fixes #713

Validation

• go test ./cmd/nvcf-trust-bundle-install -count=1
• go test ./internal/transporttls -count=1
• go test ./pkg/trustbundle ./pkg/types/nvca/config -count=1
• bazel test //pkg/operator/reconcile:reconcile_test --test_filter='Test(ConfigMapAddHandler_SkipsInitialListForOperatorConfig|SyncCurrentBackendForConfigMapChange_WrapsError|ConfigMapChangesForceNVCAReconcile)'
• bazel test //internal/miniservice:miniservice_test --test_filter='Test.*TransportTLS'
• bazel test //pkg/nvca:nvca_test --test_filter='Test.*TransportTLS'
• bazel test //cmd:image_contents_test //cmd/nvcf-trust-bundle-install:nvcf-trust-bundle-install_test

The complete reconciliation Bazel target is blocked locally by an unchanged macOS test helper: it cannot patch os.Exit and then dereferences the nil patch in cleanup. The targeted reconciliation tests above pass in the same Bazel environment.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a81b8fa8-812d-4938-98a7-ec628899fecb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mikeyrcamp]

Superseded by #718, which combines this worker-init installer and #713 follow-up with the mainline transport-TLS work.