fix(dataprotection): validate restored PV provenance before completion - #10778

Part 4 of 4 for #10755.

Problem

An already-bound target PVC was accepted as restore output without checking the target PV's claimRef or population-source annotation. Concurrent updates during the PV-to-PVC handoff could also overwrite a binding or leave the helper PV assigned to a target that uses another PV.

Changes

• Validate the target PV's claimRef namespace, name and UID, and check that its populate-from annotation matches the target dataSourceRef name. Validate an existing target binding before initiating a helper-to-target PV transfer.
• Wait when the target PV is not visible or its claimRef does not yet match. For helper PVs, wait for an absent or incomplete claimRef; reject a complete foreign owner.
• Use resourceVersion-based optimistic locking for the PV transfer, helper PV rollback and target PVC binding.
• Resume an interrupted PV-first transfer: finish binding the target PVC, or restore the helper PV's claimRef before reporting an invalid concurrent target binding.
• Separate population completion from postReady completion. Check binding and release population resources before processing postReady; an already-released population still proceeds through postReady.
• Return ordinary errors to controller-runtime for rate-limited retry. Explicit waits use delayed requeue, and fatal errors update the Restore condition. Non-deleting bound PVCs with terminal Restore conditions do not require source lookups.

Scope

Changes are confined to VolumePopulator and its tests. Validation uses the controller's cached client and the existing populate-from annotation. The annotation is a source-name check, not a unique restore-attempt identity or a provisioner compatibility check.

Validation

• Full controllers/dataprotection suite, including envtest.
• Focused tests for binding completion, target and helper claimRefs, population-source validation, resource preservation, concurrent PV/PVC updates, and interrupted-transfer recovery through Reconcile.
• Rollback conflict retry and both Succeed/Provisioned populations continuing through postReady.
• Dataprotection lint and diff whitespace checks.

Fixes #10755