fix: watch Postgres CRs to resolve active-engine race condition

[Starefossen]

Problem

When a new Postgres CR is created, both pgrator and naiserator reconcile simultaneously. If naiserator reads the Postgres CR before pgrator has set the active-engine annotation, naiserator enters a 30-minute retry loop (FailedPrepare):

Error: Status: failure: Application/ssbno-statreg (FailedPrepare): preparing rollout configuration:
waiting for pgrator to set active-engine annotation on ssbno/statreg-api-test-db; will retry

Solution

Add a metadata-only Watch on data.nais.io/v1 Postgres CRs in both the Application and Naisjob controllers. When pgrator persists the active-engine annotation, the watch triggers a re-reconcile of any app/job in the same namespace whose spec.postgres.clusterName matches.

Safety

• Hash-based skip: The synchronizer's hash check ensures that apps already synced successfully are a no-op on re-reconcile
• After FailedPrepare: The hash is NOT saved, so the re-triggered reconcile proceeds past the hash check and succeeds
• Metadata-only watch: Uses WatchesMetadata — no full Postgres spec is fetched, only annotations/labels
• Namespace-scoped list: The map function only lists apps in the same namespace as the changed Postgres CR
• Existing RBAC: The helm chart already grants get;list;watch on data.nais.io/postgres

Companion PR

• fix: persist annotations even when Prepare() fails pgrator#97 — defense-in-depth: persist annotation even on Prepare failure

Closes #674