vcluster-backend fidelity contract + SyncError taxonomy

[jleni]

Context

When a pool uses the vcluster backend it inherits vcluster's known upstream gaps wholesale — IRSA/OIDC token projection (loft-sh/vcluster#1310, loft-sh/vcluster#1275), PDB math (loft-sh/vcluster#894), two-way finalizers (loft-sh/vcluster#283), env precedence (loft-sh/vcluster#1031). kobe wraps these; it does not fix them. Today they fail silently.

Proposal

• Emit named, alertable signals for what the vcluster backend faithfully translates vs silently drops; document a per-backend fidelity contract.
• Route IRSA/webhook-heavy tenants to real-node backends (CAPI ClusterClass, CAPI real-node support via ClusterClass (Proxmox/CAPMOX + KubeVirt/CAPK) #12, or a native dedicated-control-plane backend, kobe-old#175) rather than vcluster.

Acceptance

"Works in real k8s, silently wrong on the vcluster backend" becomes a visible metric, not a surprise.