Refactor VirtualMCPServer controller to use runtime-reported status

[JAORMX]

Description

Refactor the VirtualMCPServer controller to delegate operational state management to the vMCP runtime. The controller should focus on infrastructure provisioning while the runtime owns backend discovery and health reporting.

Background

Currently the controller and runtime both discover backends:

• Controller: discoverBackends() at reconcile time → status.discoveredBackends
• Runtime: k8sDiscoverer at request time for routing

This creates duplication and stale status. Per team discussion: "the vmcp server should be k8s aware and do most of the work instead of operator needing to do it all."

Current vs Target State

Controller Responsibilities

Responsibility	Current	Target
RBAC, Deployment, Service, ConfigMap	✅ Keep	✅ Keep
Validate GroupRef exists	✅ Keep	✅ Keep
Set status.URL	✅ Keep	✅ Keep
Infrastructure conditions	✅ Keep	✅ Keep
Backend discovery	⚠️ Controller	❌ Remove
Backend health status	⚠️ Inferred	❌ Remove
status.discoveredBackends	⚠️ Controller	✅ Read from runtime
status.Phase	⚠️ Inferred	✅ Read from runtime

Runtime Responsibilities (via StatusReporter)

Responsibility	Current	Target
Dynamic backend discovery	✅ Has	✅ Keep
Backend health monitoring	⚠️ Partial	✅ Full ownership
Report status.discoveredBackends	❌ None	✅ Add
Report status.Phase	❌ None	✅ Add

Implementation

Phase 1: Enable Runtime Reporting

Depends on: #2854 (StatusReporter abstraction)

Phase 2: Controller Reads Runtime Status

• Controller observes status changes via watch (already configured)
• Remove redundant discoverBackends() call
• Set infrastructure-only conditions

Files to Modify

cmd/thv-operator/controllers/virtualmcpserver_controller.go:

• Remove discoverBackends() function
• Remove backend health inference logic
• Simplify Reconcile() to infrastructure-only

cmd/thv-operator/controllers/virtualmcpserver_deployment.go:

• Add VMCP_NAME and VMCP_NAMESPACE env vars for runtime identity

Reconciliation Flow (After)

Reconcile()
├── Validate GroupRef exists
├── Ensure RBAC (ServiceAccount, Role, RoleBinding)
├── Ensure ConfigMap with vMCP config
├── Ensure Deployment (with env vars for identity)
├── Ensure Service
├── Set infrastructure conditions (DeploymentReady, ServiceReady)
├── Set status.URL
└── Done (runtime reports operational status)

Acceptance Criteria

• Remove discoverBackends() from controller
• Controller sets only infrastructure conditions
• Runtime reports status.discoveredBackends via StatusReporter
• Runtime reports status.Phase (Ready/Degraded/Failed)
• No duplicate backend queries between controller and runtime
• E2E test validates runtime status appears in CRD
• Documentation updated for new responsibility split

[jhrozek]

Proposed Scope Expansion

Issue #2857 was filed concurrently covering similar ground. Proposing to merge that scope here since this issue is already part of the epic hierarchy.

Summary

Both issues aim to make vMCP own runtime discovery while the operator handles only infrastructure. The key additions from #2857:

• Informers: vMCP watches MCPServer/ExternalAuthConfig/Secret via controller-runtime
• Dynamic Registry: Mutable backend registry with change notifications
• Auth Resolution: Move from operator to vMCP (including secret fetching)
• Status Mechanism: TBD - either StatusReporter or /status polling (implementation detail)

Next Steps

A design doc will be created to flesh out the details and get alignment before implementation.

Closing #2857 as duplicate.