Wire up the operator to read DatastoreMigration CRs and react to
migration phase changes:

- Defer APIServer reconciliation during Migrating phase to avoid
  fighting over the APIService resource
- Trigger operator restart on Converged phase to switch to v3 CRD mode
- Create/delete dynamic migration RBAC for kube-controllers based on
  whether a DatastoreMigration CR exists
- Check DatastoreMigration CR at startup to handle operator restarts
  during or after migration

- Return errors from GetPhase/Exists so callers can distinguish
  transient failures from "no migration CR exists"
- Accept context.Context in WaitForWatchAndAdd for clean shutdown
- Fix setAPIGroupEnvVar to handle multi-container pods correctly
- Move DatastoreMigrationGVR into datastoremigration package and
  have version.go call GetPhase directly, eliminating duplicated
  phase-checking logic
- Derive GVK from GVR in WaitForWatchAndAdd instead of inline literals
- Add comment noting migration RBAC is time-bounded

Replace dynamic client with a controller-runtime cached client for
DatastoreMigration CR lookups. Add minimal stub types registered with
the scheme so the manager's cache can watch these objects, and gate
queries on watch readiness to avoid uncached API server requests.