feat: validate extraConfig against a per-release option catalog

[berendt]

Closes #703

Summary

A misspelled option name in spec.extraConfig used to reach the rendered
config file unchanged and surface as a crash-looping pod. This branch
validates extraConfig option and section names at admission against a
per-release option catalog extracted from the service image forge ships,
for both the Keystone and Glance operators.

The three decisions fixed with the author hold throughout: unknown
sections are rejected (with an exemption list for plugin and dynamic
sections plus the ownership registry), UPDATE re-validates only when a
validated input changed (extraConfig, the plugin section set, or the
release field), and an unresolvable catalog fails open with a single
admission warning, backed by a CI gate that requires a parseable catalog
for every shipped release.

Change set (in commit order)

1. feat(common): add per-release option catalog module — adds
   internal/common/config/catalog.go (+ test), the shared,
   webhook-agnostic entry point. ParseOptionCatalog reads a
   service/release catalog; FindUnknownOptions reports options no
   release accepts and deprecated-but-accepted options, exempting oslo
   plugin/dynamic sections whole and ownership-registry (section, key)
   pairs individually via KeyExemptionsFromRegistry. Pure functions, no
   Kubernetes or webhook dependencies, so both webhooks — and the future
   ControlPlane caller (Expose freeform service configuration on the ControlPlane #704) — can consume it directly.

2. feat(images): generate per-release option catalogs from service images — adds hack/gen-option-catalog.sh, which runs the image's
   own oslo-config-generator --format json against the upstream
   generator config for the pinned release and post-processes it into the
   compact catalog format. Option/deprecated/replacement names are
   normalized from the generator's dash spelling to the underscore spelling
   oslo reads from a file. A plausibility floor (≥10 sections, ≥100
   options, a DEFAULT section) guards against a truncated run
   overwriting a good catalog. Commits the four generated catalogs
   (keystone + glance × 2025.2 + 2026.1) as byte-stable caches, plus the
   gen-option-catalogs / verify-option-catalogs Makefile targets.

3. feat(keystone): validate extraConfig against the release option catalog — the keystone validating webhook embeds the per-release
   catalogs and rejects unknown extraConfig options/sections against the
   release derived from spec.image.tag. Sections from spec.plugins and
   ownership-registry keys are exempt; a digest pin or unshipped release
   fails open with one warning; deprecated options are accepted with a
   warning naming their replacement; UPDATE re-runs only on a relevant
   change. Because the gate now fires on the config-pruning marker key,
   that e2e test switches its marker to a real oslo.log option.

4. feat(glance): validate extraConfig against the release option catalog — mirrors the keystone check in the glance webhook, keyed off
   spec.openStackRelease. Additionally exempts the reserved
   glance_store sections os_glance_staging_store /
   os_glance_tasks_store whole, while an arbitrary backend-named section
   is still rejected (backend options belong on the GlanceBackend CR,
   not spec.extraConfig).

5. ci: gate service images on regenerated option catalogs — on PRs
   the build-service-images job re-extracts each catalog from the freshly
   built image via gen-option-catalog.sh --check (passing SOURCE_DIR so
   release patches are honored) and diffs against the committed file; the
   post-merge verify-service-images job repeats it against the pushed
   composite image. A new per-release gate in verify_release_config.sh
   requires a parseable catalog for every release under releases/, which
   keeps the webhook's fail-open path unreachable on main for known
   releases. Catalog paths and the generator script join the workflow path
   filters.

6. test(e2e): add unknown-option and unknown-section invalid-cr fixtures — pins the admission-time rejection through chainsaw for both
   operators. Each invalid-cr suite gains two generated fixtures (a typo'd
   option in a known section, and a typo'd section name) asserting the
   no such option/section in the <service> 2025.2 option catalog webhook
   messages.

7. docs: document admission-time extraConfig catalog validation —
   documents the catalog check in the Keystone/Glance CRD references and
   the advanced-configuration guide (rejection of unknown sections/options
   with the section and key named; plugin/operator-owned/Glance-store
   exemptions; deprecated-and-unresolvable warn-not-block; webhook-only,
   no CEL backstop), and rewrites the stale "content is not validated"
   claim.

Notes for the reviewer

• The catalog module is deliberately webhook-agnostic and carries no
  field.Error; each webhook renders its own paths and messages so the
  planned Expose freeform service configuration on the ControlPlane #704 ControlPlane caller can attribute a finding to the level
  that contributed the key. The ControlPlane wiring itself is not in
  this branch — it is the Expose freeform service configuration on the ControlPlane #704 follow-up.
• Keystone keys the catalog off spec.image.tag, Glance off
  spec.openStackRelease, matching how each operator already names its
  release. Both fall open (warn, don't block) when the release cannot be
  resolved to an embedded catalog.
• gen-option-catalogs / verify-option-catalogs need docker + network
  and are intentionally wired into no aggregate target; the CI gates run
  the check against built images instead.

---

Implemented by planwerk-agent c4682b7 with Claude:claude-opus-4-8