Implement a strict vs dev-friendly ingress readiness flag for MCPServer phase

[Agent-Hellboy]

Goal

• Today MCPServer PHASE stays PartiallyReady in NodePort-style
  clusters (k3s) because Ingress.status.loadBalancer is empty even
  when routing works.
• Add a flag so operators can choose:
  • strict (prod): require Ingress.status.loadBalancer.ingress[]
    non-empty
  • permissive (dev/NodePort): consider ingress ready once the
    Ingress exists and has rules

Repo locations

• Ingress readiness logic: internal/operator/controller.go
  checkIngressReady()
• Phase computation: internal/operator/controller.go determinePhase()
• Operator wiring: cmd/operator/main.go (builds
  operator.MCPServerReconciler{...})
• Existing tests: internal/operator/controller_test.go
  TestCheckIngressReady

Design

• Add IngressReadinessMode string to operator.MCPServerReconciler
• New env var read by operator: MCP_INGRESS_READINESS_MODE
  • default: "strict"
  • allowed values: "strict" and "permissive" (treat anything else
    as strict, or validate and log)
• Wire env var into reconciler in cmd/operator/main.go

Behavior changes

• checkIngressReady():
  • If .status.loadBalancer.ingress[] non-empty => ready (always)
  • Else if mode != permissive => NOT ready (strict behavior)
  • Else (permissive) => ready if len(ingress.Spec.Rules) > 0
    (Ingress exists with routing rules)

Tests

• Keep existing strict-mode tests unchanged.
• Add a new test case:
  • Ingress exists, has rules, LB status empty => strict returns
    false, permissive returns true.

Ops usage

• Prod (default): no change.
• Dev / k3s NodePort: set MCP_INGRESS_READINESS_MODE=permissive on
  operator deployment/env.

Note

• This is specifically about readiness semantics; route can work via
  Traefik NodePort even when Ingress LB status is empty, so strict
  mode can cause “PartiallyReady” forever in that setup.