Fix panic when resolving secrets on first reconcile

[steiler]

Summary

• Initialize the pre-fetched secret map in detectChange when no SensitiveConfig exists yet, instead of returning nil
• Add a defensive nil-map guard in buildLeafResolver so callers cannot trigger a panic on map assignment
• Add a regression test covering the nil fetched map path

Context

On first reconcile (configChanged: true, no existing SensitiveConfig), the resolver passed a nil fetched map into buildLeafResolver, which panicked with assignment to entry in nil map when caching a fetched secret.

Test plan

• go test ./pkg/reconcilers/configresolver/... -run Test_buildLeafResolver
• Apply a Config with vars.secretRef on a fresh cluster (no existing SensitiveConfig) and confirm the resolver reconciles without panic

Made with Cursor

[severindellsperger]

LGTM