Add PersistentKeepalive, consolidate resource rendering, fix docs (#4, #1)

[jacaudi]

Implements #4 and #1, the two Phase 0 foundations, plus a documentation pass. Three independent commits, reviewable separately.

Rebased onto a4c7b78 and no longer touches CI. This PR originally carried a fourth commit adopting an orchestrator CI pipeline; #43 landed that work instead, so it has been dropped wholesale. The diff now contains no file under .github/, no release-please config, and no .releaserc.json. Commit subjects were rewritten to conventional-commit form so release-please — live on main since #43 — reads them; authors, dates and bodies are unchanged.

feat: — Add PersistentKeepalive to generated peer configs (#4)

Peer configs carried no PersistentKeepalive, so an idle client would not retry a handshake until it had traffic of its own, and its NAT/conntrack entry would expire leaving the server unable to initiate toward it. That matters most right after the server pod is rescheduled, which is this operator's primary recovery path.

Adds spec.persistentKeepalive as *int32 with a CRD default of 25. The pointer is load-bearing: WireGuard reads 0 as disabled, and a plain int32 with omitempty could not distinguish "user asked for 0" from "user said nothing". The Go constant is only the nil fallback for objects stored before the field existed.

The line is rendered once and interpolated into all three config flavors — tunnel, dual-mode direct, and plain. When disabled the interpolated string is empty, leaving output byte-identical to before.

release.yaml is regenerated in this commit. It is the documented install path and a generated artifact, so the new CRD property would otherwise fail hack/release-file-drift.sh. Regenerated at the committed image pins — bumping those is release-time work.

refactor: — Consolidate resource rendering onto internal/resources builders (#1)

internal/resources was entirely dead code: all four builders were constructed in SetupWithManager but no method was ever called, because each resource was rendered by an inline function on the reconciler instead. The two copies had already drifted.

Repoints all twelve call sites, deletes the six inline functions, and removes the duplicated constants (plus labelsForWireguard, which only the deleted functions called).

Three deliberate differences in rendered output:

resource	change	effect
Deployment	metrics container port now emitted	declarative only; a metrics Service already targets it
Deployment	http container port was 51820 while both probes target 8080	declarative only; wrong in both copies, so not drift
ConfigMap	builder sets empty Data map vs nil	omitempty omits a zero-length map — serialized object unchanged

None of these reach existing deployments: the reconciler only re-renders on four triggers (agent image, userspace flag, wstunnel sidecar, scheduling settings) and none compares container ports. Declarative reconciliation is #2.

docs: — Correct and extend project documentation

• README support link pointed at the upstream issue tracker; this fork has its own.
• README features list omitted IPv6 support and per-peer egress network policies, both implemented.
• README install instructions silently install the upstream operator, which is diverging from this fork. The URLs are left working, since this fork has no release to point at, but the divergence is now called out with a pointer to [P6] Fork housekeeping: Go module path #36.
• ROADMAP 0.1 still described consolidating only the two Deployment builders, from before that scope was widened to all four. Now matches the issue and the implementation.
• CONTRIBUTING was a single placeholder line. It now documents the build and codegen entry points, which generated files must never be hand-edited, and the engineering practices this work is held to.

Verification

The original version of this PR shipped unverified — nothing had been compiled or tested, because the Go toolchain and module proxy were unreachable in that environment. That is no longer true. Everything below was run locally against this branch:

gate	result
task ci	exit 0 — golangci-lint 0 issues, govulncheck 0 affecting, go mod tidy -diff clean, fmt clean
go test ./... -race	pass
task go:integration (envtest, -race, -tags=integration)	pass, internal/controller 78.8s
make manifests generate	no diff under config / api
sh hack/release-file-drift.sh	release.yaml matches config/

Four things worth calling out, since they are exactly what the earlier version could not check:

• The hand-written generated files were correct. make manifests generate produces no diff, so the by-hand persistentKeepalive CRD schema and the zz_generated.deepcopy.go pointer copy match what controller-gen v0.16.5 emits.
• The new tests actually run. internal/controller is behind //go:build integration as of ci: adopt the fleet taskfile and lint baseline, and clear the debt it surfaces #42; the new specs carry the tag and were proven to execute rather than to be silently skipped — a focused run reports Will run 4 of 23 Specs … 4 Passed, and the suite takes ~78s rather than seconds.
• The lint ratchet was live. new-from-merge-base: origin/main resolved its merge base; had it failed open it would have reported the 113 pre-existing findings instead of 0.
• release.yaml drift is a new gate this PR predates. Adding a CRD property changes the rendered manifest, so it is regenerated in the feat: commit.

Closes #4
Closes #1

🤖 Generated with Claude Code

https://claude.ai/code/session_01XcHdnmhuAbyBYG2VfwuPDD