feat: detect and warn when OVN routingViaHost is not enabled

[Bobbins228]

Summary

Adds a startup-time network configuration check that detects when OVN-Kubernetes routingViaHost is not enabled on OpenShift clusters. Without this setting, Istio ambient mode's ztunnel cannot intercept pod-to-pod traffic and mTLS/authorization policies are silently bypassed. The operator logs a warning at startup — no per-CR conditions, no per-reconcile overhead.

Changes

• network_check.go — NetworkOperatorCRDExists (CRD discovery at startup) and CheckOVNNetworkConfig (reads network.operator.openshift.io/cluster, returns a warning string if misconfigured)
• cmd/main.go — runs the check once at startup after CRD discovery, logs warning if misconfigured
• RBAC — get on operator.openshift.io/networks in config/rbac/role.yaml and Helm chart
• network_check_test.go — 5 unit tests covering misconfigured OVN, correct config, non-OVN clusters, and missing resource

[ChristianZaccaria]

Thanks for tackling this, we may need to reconsider the approach, please see comments below for more info.

[ChristianZaccaria]

We should reconsider the approach here. For context, the network check is a cluster-level fact and not per-workload concern. It doesn't vary per agent or runtime, hence the agenruntime_controller shouldn't be responsible for performing this check.

Moreover, with the changes in agentruntime_controller, this would mean per N agents, you get N API calls on every reconcile which can be a lot.

Simpler approach: Do the check once at startup + log warning if necessary in main.go:

Startup check + log warning. Run CheckOVNNetworkConfig once in main.go right after NetworkOperatorCRDExists. Log a clear warning. Expected around <50 lines of code total, zero per-reconcile overhead, no per-CR conditions to maintain. Operators see it in the pod logs.

[ChristianZaccaria]

We can remove the whole struct:
Since we probably won't propagate the conditions or messages to the AgentRuntime CR, we can remove them entirely, and just return a simple string to be logged by the operator.

[Bobbins228]

Addressed both review comments:

1. Moved check to startup — CheckOVNNetworkConfig now runs once in main.go right after NetworkOperatorCRDExists. No per-reconcile overhead, no per-CR conditions to maintain. The reconciler is untouched.

2. Removed NetworkCheckResult struct — CheckOVNNetworkConfig returns a plain warning string (empty = no issue). ~350 lines removed from the PR.

RBAC narrowed to just get (single read at startup, no list/watch needed).