Add an enforce flag to MCPRegistry

[jhrozek]

Extends the MCPRegistry CRD with a new enforce flag. This flag defaults to false, but when set to true, the MCP server controller will only reconcile serves that are present in one of the enforcing registries.

Fixes: #1976

[codecov]

Codecov Report

❌ Patch coverage is 73.05389% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.90%. Comparing base (8b9ac40) to head (c6c0efb).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...d/thv-operator/controllers/mcpserver_controller.go	34.09%	28 Missing and 1 partial ⚠️
cmd/thv-operator/main.go	0.00%	9 Missing ⚠️
...md/thv-operator/pkg/validation/image_validation.go	93.85%	5 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1997      +/-   ##
==========================================
+ Coverage   47.76%   47.90%   +0.14%     
==========================================
  Files         232      233       +1     
  Lines       29007    29170     +163     
==========================================
+ Hits        13856    13975     +119     
- Misses      14126    14166      +40     
- Partials     1025     1029       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dmartinol]

thank you for submitting these changes!
some minor comments that would not prevent the approval, and a couple of general comments that I'd like to address before.

• What happens if the MCPServer is annotated to match a given registry? Shouldn't we restrict the validation to run only againts that registry?
• Generally speaking, the term ImageValidation seems to minimize the feature, because we could extend it to validate the annotations (see ^) and also verify that the associated server exists, is in Active status and also secure and so on (we could add more annotations for that).

Apart from these nits, that can be addressed later, looks good!

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[jhrozek]

Thank you for the review @dmartinol I implemented the suggestions as individual patches. I must say that because this week is a "conference" week for us I haven't had that much time testing it - I'll do that in a couple of hours in the meantime I wanted the CI to have a go.

[Copilot]

Pull Request Overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}