fix(gateway): recover DNS intent after endpoint deletion

[reoring]

Problem

A generated Gateway EndpointRecordSet can still be terminating when an HTTPRoute becomes accepted again. The source controller updates the terminating object and returns success; when provider cleanup removes its finalizer, the intent disappears. Only Route/Gateway events were watched, so an otherwise healthy publication can remain without DNS indefinitely.

Observed on payment.appthrust.dev: HTTPRoute Accepted/ResolvedRefs and Gateway addresses were current, but generated endpoint and Core records were absent. The exact live deletion ordering remains an inference; the controller failure class was reproduced locally.

Change

• Watch generated EndpointRecordSet creation, deletion, generation, and label changes, mapping management labels back to current routes through a parent-Gateway index.
• Leave terminating intents to endpoint/provider cleanup and recreate from the eventual deletion event.
• Avoid rewriting unchanged endpoint spec/labels; ignore status-only endpoint events.
• Preserve accepted-route publication requirements and document recovery ownership.

No public API, RBAC, provider cleanup, or publication-authority changes. No direct live DNS changes.

Verification

Development-only, Kubernetes 1.36.0 envtest with the real controller-runtime manager/cache/watch:

• Before fix: deletion-completion recovery timed out without another parent event.
• After fix: identical scenario recreated the intent with a new UID from the child delete event alone; idle resourceVersion remained stable and a subsequent real Gateway address change converged.
• Focused Gateway package tests passed, including terminating/unchanged no-write and accepted-versus-withdrawn recovery regressions.
• Focused go vet passed.
• golangci-lint v2.11.4 changed-line check: 0 issues. Full package lint reports five pre-existing unused helpers; those unrelated helpers are intentionally unchanged.
• gofmt and git diff --check passed.

Throwaway envtest scaffolding was removed after verification. Existing source CI provides broader integration checks. No release/certification or live deployment performed.

[reoring]

Release candidate: appthrust/dns-api v0.2.8
Selected main source: b229115
Tested candidate: 1cdb703
Git tree equality verified with git diff --exit-code HEAD origin/main after merge.
Local image from repository Dockerfile: sha256:3e3858ab4c556052aeb6b778cca40654cb8eee74f4208739f24c42b59bc83baf
Build inputs: Dockerfile, .dockerignore, go.mod, go.sum, app/, pkg/, internal/ from that source tree; compiler image golang:1.26.2, runtime gcr.io/distroless/static:nonroot.
Pre-publication non-authoritative local-image Kind proof passed:

• Real manager Deployment ready, runtime image matched, zero restarts.
• EndpointRecordSet finalizer completion regenerated DNS intent without parent mutation.
• Withdrawing Route acceptance removed DNS intent.
• No Zone/provider credentials configured; no cloud DNS operations performed.
• Task-owned Kind cluster dns-api-pr5-1cdb703 and its kubeconfig deleted after success.
  Closure for version tag release: ghcr.io/appthrust/dns-api:0.2.8 (linux/amd64, linux/arm64) and oci://ghcr.io/appthrust/charts/dns-api:0.2.8.
  Existing controller-release.yml is the publication authority; no publisher identity/visibility/retention change.
  This is the DNS-API repository tag/OCI release, not a signed Platform canonical catalog or environment promotion.

[reoring]

Merge and release tracking result

• PR fix(gateway): recover DNS intent after endpoint deletion #5 merged as b229115.
• Exact PR head controller-ci and headlamp-plugin-ci succeeded.
• Exact merge controller-ci succeeded: https://github.com/appthrust/dns-api/actions/runs/34022299388
• Automatic edge publication succeeded: https://github.com/appthrust/dns-api/actions/runs/34022299392
• Annotated tag v0.2.8 resolves to that exact merge commit.
• Version publication succeeded, both image and chart jobs: https://github.com/appthrust/dns-api/actions/runs/34022565139

Registry readback

• Image: ghcr.io/appthrust/dns-api:0.2.8
• OCI index: sha256:7027332c2a97d4a146d6307c4d743dbc191bd41d5f22bcb1f0774b028bf67851
• AMD64 manifest: sha256:85b27bad26674869fc614cefec3bad90df4d631b5cd89c25ff532a123abbd018
• ARM64 manifest: sha256:0fce8a612c7106ae4eb61ef7b24f929755a91daa20f20a3e3739a7ee7b29a517
• Both image config revision labels match the merge SHA and version 0.2.8.
• Chart: oci://ghcr.io/appthrust/charts/dns-api:0.2.8
• Chart digest: sha256:f29ab40dfc0347bd975ae87af34ae5cbae2347bd1c38c9ab19c81f247dd83522
• helm show chart confirms version=0.2.8 and appVersion=0.2.8.

Important artifact acceptance failure

ARM64 is NOT ready: its /manager binary is x86-64, confirmed by extracting the executable from the ARM64 manifest. Tracked with exact evidence in #6 . Workflow success and manifest platform labels are not sufficient architecture acceptance. The published tag was not overwritten or rerun.

The Gateway DNS recovery source and local AMD64 image/Kind scenario passed. Test-owned Kind cluster, kubeconfig, and stopped inspection container were cleaned up. No shared/live deployment, Payment DNS mutation, ARM64 runtime certification, or Platform signed-catalog certification was performed.