Fix Fleet API protection bugs and add two-phase secret deletion

[prashanthd409]

Summary

Fixes critical bugs in the Fleet API transient issue protection and adds a two-phase deletion mechanism with a configurable grace period, preventing ArgoCD cluster secrets from being deleted when the Fleet API temporarily returns partial data.

Changes

Fixes the fallthrough bug where suspicious data was cached, adds mutex protection for concurrent map access, introduces annotation-based two-phase deletion with a 60s grace period, replaces time.Sleep with context-aware retries, reuses the Kubernetes clientset, and adds race-safe tests including an incident replay scenario.

Test plan

• go test -v -race -count=1 ./... — all tests pass, race detector clean
• go vet ./... — no issues
• Incident replay test: 14→9→14 in 22s → zero deletions
• Two-phase lifecycle: mark → wait → delete OR mark → recover
• HTTP handler error path terminates correctly
• Fallthrough: transient + no cache → error, not bad data
• Concurrent Refresh + PluginResults under -race

Detailed changes

Bug fixes

1. Fallthrough bug (fleetclient.go): When transient issue detected on final retry with expired cache, execution fell through to cache and return suspicious data. Now returns an error.
2. Race condition (fleetclient.go): MembershipTenancyMapCache and ScopeTenancyMapCache written by Refresh() with no lock while read by HTTP handlers. Added sync.RWMutex.
3. Missing return (main.go): After PluginResults error, HTTP handler wrote 500 but continued to write a second response.

Safety features

4. Two-phase deletion (fleetclient.go): pruneSecrets no longer deletes immediately. Absent secrets get fleet.gke.io/absent-since annotation; only deleted after configurable grace period (default 60s). Recovered memberships get annotation removed.
5. Context-aware retry (fleetclient.go): time.Sleep replaced with select on time.After/ctx.Done() so retries respect context cancellation.
6. Goroutine leak fix (fleetclient.go): startReconcile now uses time.Ticker + ctx.Done() instead of infinite for/time.Sleep.

Performance

7. Reuse Kubernetes clientset (fleetclient.go): Created once in NewFleetSync() instead of every reconciliation cycle.
8. Parse template once (fleetclient.go): Package-level template.Must instead of per-iteration parsing.

CI & config

9. Race detector in CI (golangci-lint.yml): Added go test -v -race -count=1 ./... step.
10. ApplicationSet demo (applicationset-demo.yaml): Updated to applicationsSync: create-update and preserveResourcesOnDeletion: true.
11. New env var: DELETION_GRACE_PERIOD_SECONDS (default 60).

Backward compatibility

• Zero breaking changes to Connect Gateway URLs, secret format, HTTP API, or PluginResults
• Old code ignores fleet.gke.io/absent-since annotation — clean rollback
• Legitimate removals take 60s grace period before deletion (intentional)