[FEAT repo-guard] - Consolidate configuration source of truth and validity

[onuryilmaz]

[FEAT repo-guard] - Implement Validating Admission Webhooks for CRDs

Description

Currently, CRD validation relies on OpenAPI schemas. Add a Validating Admission Webhook to perform complex cross-field validation (e.g., verifying that a GithubTeam refers to an existing GithubOrganization in the same namespace) and prevent invalid configurations from reaching the controllers.

Labels

• feature
• kubernetes
• security

User Story

As a Cluster Operator I can validate CRDs before they are applied, so that configuration errors are caught early and don't cause reconciliation failures.

Benefit

Reduces "crash-looping" or error-state reconciliations by catching configuration errors at kubectl apply time.

Acceptance Criteria

• Validating Admission Webhook is implemented.
• Webhook is registered in the operator.
• Complex cross-field validation is performed.
• Unit/Integration tests cover the validation logic.
• Documentation updated with webhook details.

[uwe-mayer]

We need a well-defined set of acceptance criteria / features to harden / consolidate repo-guard config.

• cluster-scoped github orgs?
• validation for cross-namespace team collisions?