fix(kubernetes): apply namespace selector filtering to List operations

[shahar-h]

What this PR does / why we need it:
When using the Kubernetes provider with NamespaceSelector watch mode, namespace filtering after client.List operations was implemented for some resources (Gateway, xRoute, ReferenceGrant) but was missing for xPolicy resources (SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy, etc.). This caused xPolicy resources from all namespaces to be processed during reconciliation, even when those namespaces didn't match the configured selector.

This PR centralizes the namespace filtering logic by introducing a namespaceSelectorClient wrapper that automatically filters List results. This approach:

• Eliminates scattered namespace filtering checks throughout the codebase
• Ensures consistent filtering for all resource types including xPolicies
• Excludes cluster-scoped resources (e.g., GatewayClass) from filtering since they have no namespace

Note: Watch predicates in watchResources still have their own namespace filtering checks for filtering incoming events.

Which issue(s) this PR fixes:
Fixes #8305

Release Notes: Yes

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	d6a7202
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/699db292b7e186000863e1d0
😎 Deploy Preview	https://deploy-preview-8312--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 85.45455% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.83%. Comparing base (26fa4e6) to head (d6a7202).

Files with missing lines	Patch %	Lines
...l/provider/kubernetes/namespace_selector_client.go	81.81%	4 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8312      +/-   ##
==========================================
+ Coverage   73.73%   73.83%   +0.10%     
==========================================
  Files         241      242       +1     
  Lines       37077    37046      -31     
==========================================
+ Hits        27337    27353      +16     
+ Misses       7796     7761      -35     
+ Partials     1944     1932      -12     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shahar-h]

/retest

[zhaohuabing]

Nit: this can be skipped if the length of the resulting list is the same as the original one.

[shahar-h]

Done

[zhaohuabing]

Nit: Could we cache namespace match results in a map (keyed by namespace) and check that first, to avoid repeatedly calling checkObjectNamespaceLabels for objects in the same namespace?

[shahar-h]

Done

[zhaohuabing]

Hi @shahar-h thanks for the fix! This looks good overall. I left a few minor nits for follow-up.

[shahar-h]

/retest

[kkk777-7]

LGTM, thanks!

[zhaohuabing]

Hi @shahar-h — once the conflict is resolved, we should be good to go.

[shahar-h]

Hi @shahar-h — once the conflict is resolved, we should be good to go.

Done

[zhaohuabing]

LGTM. Thanks for fixing this!

[shahar-h]

/retest

[shahar-h]

/retest

[shahar-h]

/retest

[cnvergence]

thanks!

[shahar-h]

Can this be merged if there are no further comments?