Expand ownership check for profile bundle controller

The controller previously only watched ProfileBundle objects. When the
profileparser Deployment's pods changed state, the controller was never
notified.

Adding Owns means any change to the owned Deployment triggers a
reconciliation of the parent ProfileBundle, so the controller is
responsive to pod lifecycle events.

Also, once the controller found an existing pod with no startup error,
it exited the controller reconcilation loop without requeue — regardless
of whether the ProfileBundle was still in PENDING state. If the
profileparser hadn't finished (or never ran due to a rollout delay), the
controller would never check again.

This commit also updates the profile bundle controller to requeues every
10 seconds while the status is still DataStreamPending, ensuring the
controller keeps monitoring until the profileparser either succeeds
(sets VALID) or fails (sets INVALID / pod startup error detected).

This should improve the resilience of profile bundle parsing, especially
in testing, where we delete deployments after modifying the profile
bundle image to simulate operator updates.

Assisted-By: Opus 4.6

Author: rhmdnd

pkg/controller/profilebundle/profilebundle_controller.go

@@ -42,6 +42,7 @@ var oneReplica int32 = 1
 func (r *ReconcileProfileBundle) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&compliancev1alpha1.ProfileBundle{}).
+		Owns(&appsv1.Deployment{}).
 		Complete(r)
 }
 
@@ -67,6 +68,7 @@ func add(mgr manager.Manager, r reconcile.Reconciler) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		Named("profilebundle-controller").
 		For(&compliancev1alpha1.ProfileBundle{}).
+		Owns(&appsv1.Deployment{}).
 		Complete(r)
 }
 
@@ -252,6 +254,15 @@ func (r *ReconcileProfileBundle) Reconcile(ctx context.Context, request reconcil
 	// Pod already exists and its init container at least ran - don't requeue
 	reqLogger.Info("Skip reconcile: Workload already up-to-date", "Deployment.Namespace", found.Namespace, "Deployment.Name", found.Name)
 
+	// If the ProfileBundle is still pending, the profileparser hasn't
+	// finished updating the status yet. Requeue so we can detect if
+	// it fails without updating the status (e.g., pod crash, rollout
+	// delay, API connectivity issues).
+	if instance.Status.DataStreamStatus == compliancev1alpha1.DataStreamPending {
+		reqLogger.Info("ProfileBundle still pending, requeueing to check status")
+		return reconcile.Result{Requeue: true, RequeueAfter: 10 * time.Second}, nil
+	}
+
 	// Handle upgrades
 	if instance.Status.DataStreamStatus == compliancev1alpha1.DataStreamValid &&
 		instance.Status.Conditions.GetCondition("Ready") == nil {