fix: skip unchanged MCP tool writes to Postgres - #2796

The discovery-disabled path stored the server and cleared its tools on
every periodic refresh, a Postgres write every 60 s for a row that never
changes. Reuse the tool-snapshot cache from kagent-dev#2796: the empty inventory
is written when the snapshot changes and skipped otherwise. The snapshot
is taken over an empty, non-nil tool list so it differs from the row
ensureToolServerRow writes after a failed discovery.

Signed-off-by: Timo Derstappen <[email protected]>

…y=disabled without listing its tools (backport to release/v0.10.x) (#2753)

Backport of #2752 to `release/v0.10.x` (the 0.10 reconciler layout
differs from `main`, so this is a separate patch of the same change).

## Problem

A `RemoteMCPServer` that authenticates every caller has no credential to
offer the controller. Agents forward the caller's token at run time
(`KAGENT_PROPAGATE_TOKEN`), but the controller's own discovery request
(`initialize` + `tools/list`) carries no bearer: the server answers 401
and the CR stays `Accepted=False (ReconcileFailed: … Unauthorized)` for
good, although every agent that references it works. `spec.headersFrom`
is not a way out: its values are resolved into each agent's config and
applied last by the runtime (`headerRoundTripper.RoundTrip`,
`go/adk/pkg/mcp/registry.go`), so a controller credential there would
replace the propagated caller token in every agent.

## Change

- `kagent.dev/discovery=disabled` — the label
`predicates.DiscoveryDisabledPredicate` already reads to keep a Service
or `MCPServer` out of auto-discovery — now also opts a `RemoteMCPServer`
out of tool discovery: `ReconcileKagentRemoteMCPServer` skips the
listing, stores the server in the database with no tools, and reports
`Accepted=True` with reason `DiscoveryDisabled` (message names the
label), clearing `status.discoveredTools`. Any other value, or no label,
keeps discovery as it is.
- The TLS Secret hash is still computed and published with the
`DiscoveryDisabled` condition (agents fold it into their rollout hash),
and a broken `spec.tls` Secret reference still fails the server.
- The empty inventory is written once. The periodic refresh (60 s)
re-enters the opt-out path, and the tool-snapshot cache from #2796 skips
the Postgres write while the server and its (empty) tool list are
unchanged; a spec change is a new snapshot and is written again.
- The label key and value move to `consts` (`DiscoveryLabel`,
`DiscoveryDisabled`); the predicate uses them.
- The `RemoteMCPServer` controller reacts to label changes as well as
generation changes (`predicate.Or(GenerationChangedPredicate,
LabelChangedPredicate)`), so the opt-out and its removal apply at once
instead of on the next periodic refresh.
- `reconcileRemoteMCPServerStatus` is split into the existing
error→condition mapping and `setRemoteMCPServerStatus`, which takes the
condition explicitly; the unchanged-status short-circuit is kept.

The `MCPServer` part of #2752 is not needed here: `release/v0.10.x`
still filters labeled `MCPServer`s through
`predicates.DiscoveryDisabledPredicate`, which `main` lost in #2565.

## Testing

- `go test ./core/internal/controller/reconciler/ -run
DiscoveryDisabled`:
`TestReconcileKagentRemoteMCPServer_DiscoveryDisabled` reconciles a
labeled server with an unroutable URL through a recording
`database.Client` that panics on anything but the two catalog writes —
asserts the condition (`True` / `DiscoveryDisabled`), the cleared stale
inventory, the stored server with no tools, and that a second reconcile
of the unchanged server writes nothing while a description change is
written again;
`TestReconcileKagentRemoteMCPServer_DiscoveryDisabledKeepsSecretHash`
covers the published hash and the broken-reference failure;
`TestRemoteMCPServerDiscoveryDisabled` covers the label matching.
- `go build ./core/...`, `go vet ./core/internal/controller/...`.

Context: giantswarm/agent-platform#299.

---------

Signed-off-by: Timo Derstappen <[email protected]>