Extract shared WorkloadReference helpers into controllerutil

[ChrisJBurns]

Summary

• PR review feedback on Replace ReferencingServers with ReferencingWorkloads on MCPToolConfig #4506 and Replace ReferencingServers with ReferencingWorkloads on MCPExternalAuthConfig #4507 identified that the ReferencingWorkloads pattern had inconsistent sorting: MCPTelemetryConfig and MCPExternalAuthConfig sorted refs, but MCPToolConfig and MCPOIDCConfig did not. This caused unnecessary API server writes when the same workloads were discovered in different list order across reconcile runs.
• The same list-filter-build logic was also duplicated across all four config controllers, making it easy for inconsistencies to creep in.
• Extracts SortWorkloadRefs, CompareWorkloadRefs, WorkloadRefsEqual, and FindWorkloadRefsFromMCPServers into the shared controllerutil package. All four controllers now delegate to these helpers, ensuring consistent deterministic ordering and removing ~50 lines of duplicated code.

Type of change

• Refactoring (no behavior change)

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
cmd/thv-operator/pkg/controllerutil/config.go	Add SortWorkloadRefs, CompareWorkloadRefs, WorkloadRefsEqual, FindWorkloadRefsFromMCPServers shared helpers
cmd/thv-operator/pkg/controllerutil/config_test.go	Add tests for all new helpers
cmd/thv-operator/controllers/toolconfig_controller.go	Delegate findReferencingWorkloads to shared helper; add sorting in handleConfigHashChange
cmd/thv-operator/controllers/mcpexternalauthconfig_controller.go	Replace inline sort and findReferencingWorkloads with shared helpers
cmd/thv-operator/controllers/mcpoidcconfig_controller.go	Delegate MCPServer lookup to shared helper; add sorting after VirtualMCPServer append
cmd/thv-operator/controllers/mcptelemetryconfig_controller.go	Replace inline sort, local workloadRefsEqual, and findReferencingWorkloads with shared helpers

Special notes for reviewers

• This addresses the sorting inconsistency flagged in #4506 review and the duplication concern in #4507 review.
• The stale-ref watch handler and handleDeletion patterns are also duplicated but require more involved generalization (interface/generic approaches for different config list types). Those are better addressed as part of the shared config resource lifecycle work in toolhive-rfcs#65.
• The pre-existing goconst lint issue for "MCPServer" string in mcpexternalauthconfig_controller.go is not addressed here — it predates this change.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 77.58621% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.10%. Comparing base (a948281) to head (e2a43fb).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...v-operator/controllers/mcpoidcconfig_controller.go	50.00%	4 Missing and 2 partials ⚠️
.../thv-operator/controllers/toolconfig_controller.go	77.77%	1 Missing and 1 partial ⚠️
cmd/thv-operator/pkg/controllerutil/config.go	89.47%	1 Missing and 1 partial ⚠️
...or/controllers/mcpexternalauthconfig_controller.go	88.88%	1 Missing ⚠️
...rator/controllers/mcptelemetryconfig_controller.go	85.71%	1 Missing ⚠️
...perator/controllers/virtualmcpserver_controller.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4520      +/-   ##
==========================================
+ Coverage   69.02%   69.10%   +0.07%     
==========================================
  Files         502      502              
  Lines       52008    51997      -11     
==========================================
+ Hits        35899    35933      +34     
+ Misses      13320    13276      -44     
+ Partials     2789     2788       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.