fix(controller): degrade scope not whole target on RBAC-forbidden namespace

[konih]

Summary

• KollectTarget reconcile previously flipped fully Degraded (removing Ready/Synced) whenever HasForbiddenScope was true, even though collection from allowed namespaces continued — violating GUIDELINES.md §1's ErrForbidden rule ("degrade scope, never hard-fail the whole reconcile").
• Extracted reconcileTargetReady's engine-derived signals into a pure applyTargetReadyState helper so the previously-untested forbidden-scope branch is directly unit-testable without standing up RBAC-restricted envtest fixtures.
• On a forbidden scope: Ready stays True, Degraded stays absent, Synced carries a new ScopeForbidden reason + message, and a Warning event is recorded. AccessCheckFailed (a different error class — SAR API failure) and sink-unreachable both keep the prior full-degrade behavior.

Test plan

• go build ./...
• task verify (no codegen drift)
• task lint / task arch-lint (0 issues)
• task test (full unit + envtest, race on)
• task coverage (79.0%, floor 72%)
• task scrub (clean)
• task changelog:verify
• 3 new unit tests confirmed red (compile failure) before the implementation commit, green after

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 90.47619% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/controller/kollecttarget_controller.go	90.47%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[konih]

Review summary (gate matrix + analysis)

Gate	Result	Notes
go build ./...	✅
task verify	✅	no codegen drift
task lint / arch-lint	✅	golangci-lint 0 issues
task test	✅	full unit + envtest, race on
task coverage	✅	79.0% (floor 72%)
task scrub	✅	clean
task changelog:verify	✅

TDD: 3 new unit tests (TestApplyTargetReadyState_*) confirmed red (compile failure on applyTargetReadyState/reasonScopeForbidden not existing) before the implementation commit, green after.

Functional correctness: HasForbiddenScope previously routed into setDegraded unconditionally, removing Ready/Synced for the whole target even though collection from allowed namespaces continued — violating GUIDELINES.md §1's ErrForbidden rule. Now Ready stays true, Synced carries ScopeForbidden, a Warning event is recorded, and the genuinely-different AccessCheckFailed/sink-unreachable paths are unchanged (still hard-degrade, by design — different error classes).

One P3 observation, not blocking: if both HasForbiddenScope and HasAccessCheckFailure are true simultaneously, a ScopeForbidden Warning event is now emitted before falling through to the full AccessCheckFailed degrade (previously impossible since the old code short-circuited on the first true branch). Harmless — more observability, not less correct.

No P0/P1 findings. I can't self-approve this (would defeat the review requirement) — flagging here for your review/approval on GitHub.