feat(controller): restart services when dynamicConfig changes

[bmorton]

Problem

Changing spec.dynamicConfig on a TemporalCluster updated the rendered dynamic-config ConfigMap but did not restart the running service pods, so new values only took effect after a manual rollout.

The operator already solves this for static config (config-hash) and mTLS certs (cert-hash) by stamping a content hash onto the pod template — any hash change mutates the template and triggers a rolling update. The dynamic-config content was simply never included in any pod annotation.

Fix

Add a temporal.bmor10.com/dynamicconfig-hash pod annotation computed from the rendered dynamic config via the existing resources.ConfigHash helper, threaded through the pure plan.ServicesInput path (Approach A from the design — a separate annotation, mirroring cert-hash, so kubectl describe pod shows which input caused a roll).

End-to-end flow:

spec.dynamicConfig → RenderDynamicConfig → ConfigHash → DynamicConfigHash
  → plan.ServicesInput → BuildDeployment → pod annotation
  → pod template mutates → rolling restart

Both the controller reconcile path (internal/controller/temporalcluster_services.go) and the preview/plan path (internal/plan/plan.go) compute the hash from the identical RenderDynamicConfig output, keeping them in lockstep. Empty dynamicConfig hashes to a stable constant, so the annotation is always present and deterministic (no spurious rolls).

Changes

• internal/resources/labels.go — new DynamicConfigHashAnnotation constant.
• internal/resources/deployment.go — BuildDeployment takes dynamicConfigHash, stamps the annotation.
• internal/plan/services.go / plan.go — new ServicesInput.DynamicConfigHash, populated and passed through.
• internal/controller/temporalcluster_services.go — populate the hash in reconcileServices.
• Tests added at the resources, plan layers; existing controller envtest suite passes.
• Design/plan docs under docs/superpowers/.

No CRD/API type change → no manifest/Helm/API-doc regeneration.

Verification

• make build, make lint (0 issues), make test (all packages ok)
• No generated-file drift.

Note

On first reconcile after upgrading to this version, existing clusters get the new annotation added to their pod templates, causing a one-time rollout — identical to how config-hash behaved when it was introduced, and the intended mechanism.