feat(agent): surface per-CR failures as Degraded condition with cause on NodeStatus.Message

[gma1k]

• Agent reconciler now publishes tombstone CRRules (rule.Err != nil) for per-CR failures — selector match, cgroup resolve, bundle load, and exporter build — instead of silently continueing.
• StatusWriter writes the wrapped cause to NodeStatus[*].Message and forces Ready=false for tombstoned rules; the agent-global Ready callback only governs healthy rules.
• Operator's PodTraceReconciler rolls any tombstoned NodeStatus row up into ConditionDegraded=True with Reason=AgentNodeStatus, lexicographically naming the first failing node so the message stays stable across reconciles.
• User-visible benefit: ExporterConfigs with type: jaeger|zipkin|splunk|datadog (not yet implemented in the agent) now show build exporter: ... not yet implemented in agent mode on kubectl describe podtrace, instead of failing silently.