feat(kubernetes): skip classless worker pool updates in the WorkerClass admission webhooks #5275

Problem / motivation

The WorkerClass admission webhooks in #4911 are registered for every CREATE and UPDATE of a tenant worker pool. A pool without a class stays on the legacy Talos path and needs no class lookup, so the handler does nothing for it. But if the webhook is unavailable and its failurePolicy is Fail, the API server refuses the write before the handler runs.

The isolated test described in the proposal shows this: with the webhook returning HTTP 503, a classless legacy PUT failed with HTTP 500. The registrations there had no matchConditions. As a result, a legacy pool that never uses classes still depends on the worker package being up for its application writes. Right now the proposal only documents that dependency.

Proposed solution

Add a matchConditions entry to the mutating and validating webhook configurations that skips an UPDATE when neither the old nor the new object names a class. Classless pools then never depend on the package being available. CREATE and classified UPDATE keep going through the webhooks as they do now.

The change should be covered by the outage test the proposal already asks for: classless UPDATE, classified UPDATE and CREATE, each with the webhook down, recording which one is refused.

Scope check

• This affects a single component / package (the managed-Kubernetes worker package)
• I can describe the expected behavior concretely

Alternatives considered

Switching to failurePolicy: Ignore. The proposal's isolated test only showed a dry-run CREATE passing with 503, so it does not show that Ignore is safe for the other operations, and it would also let classified writes skip validation.

Additional context

Review note: cozystack/community#115 (review) ("Webhook outages and classless pools"). Implementation: #4911.