[addon-operator] fix: make module hook registration idempotent and race-free

[Glitchy-Sheep]

Overview

Fixes three bugs in the module hook machinery:

• Hook registration is idempotent and race-free:
  • AddHook replaces the old hook object in all bindings instead of appending a duplicate
  • registered / controllersReady flags are read and written under the storage lock
  • RegisterHooks is serialized with a mutex
  • getHooks returns a sorted copy instead of the shared slice
• A module no longer loses its Synchronization run after a partial failure:
  • HandleModuleEnableKubernetesBindings tries every hook and aggregates errors with errors.Join, instead of aborting on the first failure
  • on retry, shell-operator v1.20.2 re-emits Synchronization contexts for all hooks (idempotent EnableKubernetesBindings)
• Synchronization tasks are not silently dropped anymore:
  • hook queues are ensured (idempotently) at the start of the QueueSynchronizationTasks phase
  • a task that cannot be queued fails the phase and is retried, instead of leaving its binding falsely "completed" with kubernetes events locked forever

Also bumps shell-operator to the released v1.20.2.

Why we need it

Production incidents:

• 2026-05-05, 2026-06-30: startup crash loop (SIGSEGV). A failed registration attempt left hooks with a nil HookController, the retry appended duplicates next to them, and the kube-events dispatcher crashed on the stale entry.
• 2026-07-08: one hook's monitor failed to start, the whole module lost its Synchronization run. Hooks read empty snapshots while "succeeding", a beforeHelm hook wiped internal values, and the module render shrank.

Before: one transient failure poisons the hook index or drops the module's Synchronization run for good.
After: a registration retry replaces stale hooks; a partial enable failure is retried, and the retry re-emits Synchronization for every hook.

Notes for the reviewer

• Hard dependency: shell-operator >= v1.20.2 (pinned in go.mod, released). On an older version the best-effort loop makes things worse: the retry hits the old alreadyEnabled early-return and gets zero Synchronization contexts.
• Design choice: on any enable error the phase fails and retries as a whole (all-or-nothing). Partial queueing was rejected - safe retries are already guaranteed by the idempotent EnableKubernetesBindings.
• New tests, all pass with -race:
  • TestAddHookIsIdempotentPerBinding
  • TestRegistrationRetryLeavesNoOrphanHooks
  • TestControllersReadyFlagIsRaceFree
  • TestConcurrentRegisterHooksIsSafe
  • TestHandleModuleEnableKubernetesBindings_RetryAfterPartialFailure - pass 1 fails on one hook, the others still emit contexts; pass 2 re-emits for all
• Companion PRs: [shell-operator] fix: isolate panics in ManagerEventsHandler callbacks, self-heal kubernetes bindings, own shared informer lifetime shell-operator#922 (merged, released as v1.20.2), [deckhouse] fix race condition panic in addon operator deckhouse/deckhouse#21201 (bump + fault-injection verification on a dev cluster), [deckhouse-controller] fix empty snapshots deckhouse/deckhouse#21255 (release-1.76 already carries the same fixes via v1.17.7 / v1.21.19).