[CI-1951] fix(podiprecovery): add Pod watch so recovery is level-triggered

[coutinhop]

Follow-up to #4784. Two fixes to the podiprecovery controller.

1. Recovery was edge-triggered (add a Pod watch)

The Node watch alone fired only when a node's host IPs changed. On a KubeVirt
reboot, the node's new IP is reported while its host-networked pods are still
restarting (empty status.podIPs), so the reconcile skips them; when a
surviving pod later comes back with its old, now-stale IP, the node IP has
already settled and no further Node event fires — so the stale pod is never
re-checked.

Add a second watch on operator-managed host-networked Pods that re-enqueues a
pod's node when it settles (IPs appear/change, or it becomes Ready). Both
watches feed the same idempotent, node-keyed Reconcile, making recovery
level-triggered on both inputs (node addresses + pod IPs) while staying
event-driven. The predicate is gated on the host-networked label +
spec.hostNetwork.

2. Don't force a cluster-wide Pod cache (use a scoped cache)

As written, #4784 registered a Pod.spec.nodeName field index in
cmd/main.go and read pods via the shared cache — either forces a
cluster-wide Pod informer holding every pod in memory, always-on from startup.
That's a sizable memory cost at scale and a regression (the operator's other
pod readers are conditional, so the shared Pod informer was previously
lazy/absent).

Give the controller its own cache.New scoped server-side to the
operator.tigera.io/host-networked label; the watch, the per-node List, and
the spec.nodeName index all live on it, so only the handful of
host-networked pods are cached and the shared cache is untouched. The
cmd/main.go field index is removed (supersedes that part of #4784). The
scoped reader is wrapped in a hostNetworkedPodLister exposing only
"list host-networked pods on a node", so it can't be misused as a full-pod
reader (which would silently drop non-host-networked pods).

Changes

• podiprecovery: Pod watch + podToNode + hostNetPodSettledPredicate;
  dedicated label-scoped cache.New (with spec.nodeName index), wrapped in
  hostNetworkedPodLister.
• ctrlruntime: add WatchObjectInCache (watch via a supplied cache).
• cmd/main.go: remove the shared-cache Pod.spec.nodeName index from [CORE-12452] feat: auto-recover host-networked pods when node IP changes #4784.
• update mockController in utils/egressgateway tests for the new method.

Testing

Unit tests for the pod-settle predicate and podToNode mapping;
go build/go vet ./... clean; podiprecovery/utils/egressgateway tests pass.

Release Note

None

For PR author

- [x] Tests for change.
- [ ] If changing pkg/apis/, run make gen-files
- [ ] If changing versions, run make gen-versions

For PR reviewers

- [ ] Milestone set according to targeted release.
- [ ] Appropriate labels:
  - [x] kind/bug
  - [ ] kind/enhancement
  - [ ] enterprise