fix: Skip HelmChartProxy reconciliation for paused clusters

This fixes a bug leading to duplicate `HelmReleaseProxy` resources
following a `clusterctl move` that can happen due to a race between
reconciling the `HelmChartProxy` and moving and unpausing the `Cluster`.

controllers/helmchartproxy/helmchartproxy_controller.go

@@ -65,7 +65,13 @@ func (r *HelmChartProxyReconciler) SetupWithManager(ctx context.Context, mgr ctr
 	if err = c.Watch(
 		source.Kind(mgr.GetCache(), &clusterv1.Cluster{}),
 		handler.EnqueueRequestsFromMapFunc(r.ClusterToHelmChartProxiesMapper),
-		predicates.ResourceNotPausedAndHasFilterLabel(log, r.WatchFilterValue),
+		predicates.All(ctrl.LoggerFrom(ctx),
+			predicates.Any(ctrl.LoggerFrom(ctx),
+				predicates.ClusterUnpaused(ctrl.LoggerFrom(ctx)),
+				predicates.ClusterControlPlaneInitialized(ctrl.LoggerFrom(ctx)),
+			),
+			predicates.ResourceNotPausedAndHasFilterLabel(log, r.WatchFilterValue),
+		),
 	); err != nil {
 		return errors.Wrap(err, "failed adding a watch for Clusters")
 	}
@@ -218,6 +224,12 @@ func (r *HelmChartProxyReconciler) reconcileNormal(ctx context.Context, helmChar
 			continue
 		}
 
+		// Don't reconcile if the Cluster is paused.
+		if cluster.Spec.Paused {
+			log.V(2).Info("Cluster is paused, skipping reconcile", "cluster", cluster.Name)
+			continue
+		}
+
 		err := r.reconcileForCluster(ctx, helmChartProxy, cluster)
 		if err != nil {
 			return err