test: Implement unit tests for reconcilers

[kitsunoff]

⚠️ TDD MANDATORY

This issue defines the tests that MUST be written BEFORE any implementation.

Tests are not optional. They are the specification.

---

Description

Implement comprehensive unit tests following TDD approach. Tests MUST be written BEFORE implementation.

Tasks

Test Framework Setup

• Setup test suite with envtest
• Create SSH mock interface and implementation
• Create test fixtures and helpers

Machine Not Reachable Tests

• Test: Connection refused → Discoverable=False, reason=SSHFailed
• Test: Connection timeout → Discoverable=False, reason=SSHFailed
• Test: Authentication failed → Discoverable=False, reason=SSHFailed
• Test: DNS resolution failed → Discoverable=False, reason=SSHFailed
• Test: SSH key missing (Secret not found) → Discoverable=False, reason=CredentialsMissing

Configuration Apply Failed Tests

• Test: Nix build error → Stalled=True, Applied=False
• Test: Git clone error (repo not found) → Stalled=True
• Test: SSH connection lost during apply → Stalled=True
• Test: Job timeout (ActiveDeadlineSeconds exceeded) → Stalled=True

Job Cannot Start Tests

• Test: Insufficient resources (Unschedulable) → Stalled=True after 5min
• Test: ImagePullBackOff → Stalled=True, message contains "ImagePullBackOff"
• Test: Secret not found (volume mount) → Stalled=True, message contains "secret"
• Test: Node selector mismatch → Stalled=True, message contains "node affinity"

Owner Reference Tests

• Test: Job has correct owner reference (apiVersion, kind, name, uid, controller, blockOwnerDeletion)
• Test: Machine deletion blocked by referencing config → DeletionBlocked=True
• Test: Config deletion cancels running job
• Test: Config deletion clears Machine status

Secret Watch Tests

• Test: Secret creation triggers Machine reconcile
• Test: Secret data update triggers reconcile
• Test: Secret metadata-only update does NOT trigger reconcile
• Test: Secret deletion triggers reconcile

State Transition Tests

• Test: Machine Undiscoverable → Discoverable on SSH success
• Test: Machine Discoverable → Undiscoverable on SSH failure
• Test: Config Pending → Reconciling when Machine ready
• Test: Config Reconciling → Applied on Job success
• Test: Config Reconciling → Stalled on Job failure
• Test: Config Applied → Reconciling on spec change
• Test: Config Stalled → Reconciling on retry

Coverage Requirements

Component	Min Coverage
MachineReconciler	80%
NixosConfigurationReconciler	80%
SSH Client	70%

Reference

See docs/kubebuilder-migration-analysis.md section 24 for test implementations.