feat: surface objectStore upload reason, attempts, and retry logs

[gma1k]

Four hardening cuts on the existing session objectStore sink, aimed at operator-grade observability rather than new feature surface:

• Doc alignment — docs/operator.md and docs/crd-podtracesession.md no longer claim reportRef.objectStore
  is "reserved" or that the webhook rejects it. Both have been false since the feature actually landed; new copy points at
  docs/object-store-reports.md for semantics.
• Failure observability — new typed enum ReportFailureReason (InvalidURI | CredentialMissing |
  BucketNotFound | AccessDenied | NetworkTimeout | Unknown) on status.reportFailureReason, plus status.reportAttempts mirroring the sidecar's RestartCount. Two new operator-side
  Prometheus series (session_report_upload_attempts_total with result+reason labels, session_report_upload_duration_seconds histogram) for SLO and trend tracking.
• Idempotent timestamp — the sidecar persists its chosen object-key suffix to an emptyDir state file on first run and rereads it on every subsequent restart, so a kubelet-induced restart no longer produces a duplicate object under a fresh timestamp.
• Retry transparency — each S3/GCS/Azure SDK retry boundary now produces a structured JSON log line on the sidecar's stderr with backend, method, url, status, attempt, took_ms, and error. Wiring is per-SDK (S3 via awsconfig.WithHTTPClient, GCS via storage.Client.SetRetry(storage.WithErrorFunc), Azure via a policy.PerRetryPolicies entry).