fix(dataprotection): validate restored PV provenance before completion

[leon-ape]

Part 4 of 4 for #10755.

Problem

An already-bound target PVC was accepted as restore output without checking whether its PV was actually rebound by VolumePopulator.

Changes

• validate an existing target binding before changing the helper PV
• validate the target PV exists through the controller's cached client
• validate ClaimRef namespace/name and UID identify the target PVC
• validate the existing PV populate-from annotation matches the target dataSourceRef
• requeue when a cached helper PV ClaimRef is absent or incomplete; reject only a complete foreign owner
• use optimistic locking for both the PV rebind and target PVC handoff
• recover a PV-first partial handoff by either completing the target PVC binding or restoring the PV to the helper when the target was concurrently bound elsewhere

Scope

This is minimum rebind validation only. It does not add provisioner compatibility detection, attempt identity, legacy restore adoption, Cluster finalizers, cleanup refactoring, or workload changes. It performs no uncached reads.

Tests

• full controllers/dataprotection suite
• focused valid/foreign/missing-PV, cache-ordering, incomplete ClaimRef, helper-preservation, concurrent target binding, partial-handoff recovery, and concurrent PV change tests

Fixes #10755

[apecloud-bot]

Auto Cherry-pick Instructions

Usage:
  - /nopick: Not auto cherry-pick when PR merged.
  - /pick: release-x.x [release-x.x]: Auto cherry-pick to the specified branch when PR merged.

Example:
  - /nopick
  - /pick release-1.1

CLA Recheck Instructions

Usage:
  - /recheck-cla: Trigger a re-check of CLA status for this pull request.
Example:
  - /recheck-cla

[codecov]

Codecov Report

❌ Patch coverage is 63.15789% with 49 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.75%. Comparing base (305e2ae) to head (e4e6159).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...llers/dataprotection/volumepopulator_controller.go	63.15%	39 Missing and 10 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10778      +/-   ##
==========================================
+ Coverage   65.69%   65.75%   +0.06%     
==========================================
  Files         510      510              
  Lines       64860    64985     +125     
==========================================
+ Hits        42610    42732     +122     
- Misses      18462    18464       +2     
- Partials     3788     3789       +1     

Flag	Coverage Δ
unittests	65.75% <63.15%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.