[Bug] ApprovedImage validation and error handling failures

[yalzhang]

Description:
ApprovedImage resources with invalid images are accepted at admission time but fail silently.

Reproduce:

$ cat approvedimage_invalid.yaml 
apiVersion: trusted-execution-clusters.io/v1alpha1
kind: ApprovedImage
metadata:
  name: invalid-digest
  namespace: confidential-clusters
spec:
  image: quay.io/trusted-execution-clusters/fedora-coreos@sha256:invalid                                                                                                                         

 $ oc apply -f approvedimage_invalid.yaml                                                                                                            
approvedimage.trusted-execution-clusters.io/invalid-digest created

$  oc get approvedimage invalid-digest 
NAME             AGE
invalid-digest   46s      

 $ oc logs deployment.apps/confidential-cluster-operator  | grep -i fail
 [WARN  operator::reference_values] PCR computation for invalid-digest failed: invalid reference format
[WARN  operator::reference_values] PCR computation for invalid-digest failed: invalid reference format
[WARN  operator::reference_values] PCR computation for invalid-digest failed: invalid reference format
[WARN  operator::reference_values] PCR computation for invalid-digest failed: invalid reference format                                                                                                                    

Expected:
Reject at addmission time, report error like:
Error from server (BadRequest): spec.image: Invalid value: "sha256:invalid": digest must be 64 hex characters

[yalzhang]

Moved to #241

Problem 2: ApprovedImage with non-existent images shows misleading "Computing" status

When an ApprovedImage references a valid-format but non-existent image digest, the resource shows status: Computing indefinitely while the underlying compute-pcrs job is stuck in ImagePullBackOff. Users cannot determine from the ApprovedImage status alone that the operation has failed.

Reproduce:

$ cat non_exists.yaml 
apiVersion: trusted-execution-clusters.io/v1alpha1                                                                                   
kind: ApprovedImage                                                                                                                  
metadata:                                                                                                                            
  name: test-nonexistent                                                                                                             
  namespace: confidential-clusters                                                                                                   
spec:                                                                                                                                
  image: quay.io/repo/image@sha256:0000000000000000000000000000000000000000000000000000000000000000

$ oc apply -f non_exists.yaml 
approvedimage.trusted-execution-clusters.io/test-nonexistent created

$ oc get approvedimage
NAME               AGE
test-nonexistent   50s

$ oc get pods  | grep compute-pcrs 
compute-pcrs-8c34159d43-quay-io-repo-image-sha256-00000000nvgrf   0/1     ImagePullBackOff   0          2m42s

$ oc get jobs 
NAME                                                              STATUS    COMPLETIONS   DURATION   AGE
compute-pcrs-8c34159d43-quay-io-repo-image-sha256-0000000000000   Running   0/1           3m3s       3m3s      

The cr keep status as:

  status:
    conditions:
    - lastTransitionTime: "2026-03-28T08:42:13Z"
      message: Computation is ongoing. Check jobs for progress.
      observedGeneration: 1
      reason: Computing
      status: "False"
      type: Committed                                                    

Actual state:

• compute-pcrs Job created, stuck in ImagePullBackOff
• Job retries indefinitely, never reaches terminal state
• Operator logs: [WARN] Fetching PCR label failed: Not authorized
• User must check job/pod to discover actual error

Problems:

1. ❌ Status is misleading - says "Computing" but computation never started
2. ❌ No terminal failure state - operation never completes
3. ❌ Not actionable - doesn't tell user what's wrong or how to fix it
4. ❌ Poor observability - requires checking multiple resources to understand failure

Expected Behavior (GA Quality)

ApprovedImage status should reflect job failure:

  status:                                                                                                                              
    conditions:                                                                                                                        
    - type: Ready                                                                                                                      
      status: "False"
      reason: ImagePullFailed                                                                                                          
      message: "Failed to pull image: manifest unknown or not authorized"                                                              
      lastTransitionTime: "2026-03-28T08:45:00Z"                                                                                       
    - type: Committed                                                                                                                  
      status: "False"                                                                                                                  
      reason: PCRComputationFailed                                                                                                     
      message: "Cannot compute PCRs: image quay.io/repo/image@sha256:0000... is not accessible. Verify the image exists and registry   
  credentials are correct."                                                                                                            
      lastTransitionTime: "2026-03-28T08:45:00Z"