refactor: consolidate CEL filter into ShootSelector struct

[mikolajkucinski]

Summary

• shootFilter is now part of shootSelector struct with labelSelector and expression fields
• CEL filtering now happens at the watch level via predicates instead of in the reconcile loop
• CareInstruction controller deletes secrets for shoots that no longer match the CEL expression
• Label selector now uses LabelSelectorAsSelector to support both matchLabels and matchExpressions
• Added excludedShoots, excludedShootCount, and effectiveShootCount to CareInstructionStatus
• CEL filter errors now emit warning events on the CareInstruction

Breaking change: shootSelector field structure changed

Migrate existing CareInstructions with

kubectl get careinstructions -A -o json | \
  jq -c '.items[] |
    .spec.shootSelector = ({
      labelSelector: .spec.shootSelector,
      expression: .spec.shootFilter
    } | del(.[] | nulls)) |
    del(.spec.shootFilter)' | \
  while read -r ci; do
    echo "$ci" | kubectl apply -f -
  done

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/cloudoperators/shoot-grafter/api/v1alpha1	0.00% (ø)
github.com/cloudoperators/shoot-grafter/controller/careinstruction	0.00% (ø)
github.com/cloudoperators/shoot-grafter/controller/shoot	0.00% (ø)
github.com/cloudoperators/shoot-grafter/webhook/v1alpha1	0.00% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/cloudoperators/shoot-grafter/api/v1alpha1/careinstruction_types.go	0.00% (ø)	0	0	0
github.com/cloudoperators/shoot-grafter/api/v1alpha1/zz_generated.deepcopy.go	0.00% (ø)	0	0	0
github.com/cloudoperators/shoot-grafter/controller/careinstruction/careinstruction_controller.go	0.00% (ø)	0	0	0
github.com/cloudoperators/shoot-grafter/controller/shoot/shoot_controller.go	0.00% (ø)	0	0	0
github.com/cloudoperators/shoot-grafter/webhook/v1alpha1/careinstruction_webhook.go	0.00% (ø)	0	0	0

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/cloudoperators/shoot-grafter/controller/careinstruction/careinstruction_controller_test.go
• github.com/cloudoperators/shoot-grafter/controller/shoot/shoot_controller_test.go