feat(agent): wire podtrace policy, filters, sample, thresholds end-to-end

[gma1k]

Summary

End-to-end wiring of PodTrace/PodTraceSession policy fields from CR spec through the bundle ConfigMap into agent runtime behaviour and surfaced status. Three concrete fixes:

• samplePercent is now respected: Previously the field on PodTrace was read by no controller, only ExporterConfig.spec.samplePercent reached the bundle. The operator now computes min(CR, ExporterConfig) (treating unset as 100%) and writes the resolved value to the bundle. Documented as the "minimum applies" contract.
• thresholds now do something: Previously they were spec-only with no runtime consumer outside the standalone diagnose CLI. The agent's SDK exporter now evaluates fs-slow / rtt-spike / error-rate per event (stateless, no rolling window), stamps podtrace.threshold:* span attributes, and bumps a new per-CR Prometheus counter.
• filters round-trip is observable: Filters are now mirrored on the bundle and echoed in status.policy.filters so users can verify what the agent will actually apply without scraping ConfigMaps.

What's new

• New status.policy on PodTrace + PodTraceSession with effectiveSampleRate, filters, thresholds, generation, hash.
• New PolicyApplied condition.
• New per-node status.nodeStatus[].policyHash — compare against status.policy.hash to verify bundle propagation reached every node.
• Three new Prometheus series on the agent:
  • podtrace_agent_effective_sample_rate{cr_namespace,cr_name}
  • podtrace_agent_policy_generation{cr_namespace,cr_name}
  • podtrace_agent_threshold_tripped_total{cr_namespace,cr_name,threshold}