Set Ready=Unknown when reconciliation is paused

Per Kubernetes API conventions, Unknown signals that the operator is no
longer actively verifying the resource — a more honest status than
preserving a stale Ready=True while reconciliation is stopped.

- internal/paused/paused.go: set Ready=Unknown alongside Paused=True in
  EnsureCondition; both conditions land in the same status patch
- docs/concepts/pausing.md: new "Effect on the Ready Condition" section
  with YAML example, kubectl output, and rationale callout; update the
  Paused Condition kubectl example to show Ready=Unknown

Author: felix-kaestner

docs/concepts/pausing.md

@@ -55,8 +55,8 @@ condition. The `Paused` column is visible with `-o wide`:
 
 ```
 $ kubectl get vrfs -o wide
-NAME       VRF    DEVICE    READY   PAUSED   AGE
-vrf-prod   prod   leaf-01   True    True     5m
+NAME       VRF    DEVICE    READY     PAUSED   AGE
+vrf-prod   prod   leaf-01   Unknown   True     5m
 ```
 
 The condition message indicates the reason:
@@ -69,6 +69,35 @@ conditions:
     message: "Device spec.paused is set to true"
 ```
 
-::: warning
-The `Paused` condition does not affect the `Ready` condition.
+## Effect on the Ready Condition
+
+When a resource is paused, the `Ready` condition is set to `Unknown` with reason `Paused`. 
+
+```yaml
+conditions:
+  - type: Ready
+    status: "Unknown"
+    reason: Paused
+    message: "Reconciliation is paused"
+  - type: Paused
+    status: "True"
+    reason: Paused
+    message: "Device spec.paused is set to true"
+```
+
+The `kubectl get` output reflects this:
+
+```
+$ kubectl get vrfs -o wide
+NAME       VRF    DEVICE    READY     PAUSED   AGE
+vrf-prod   prod   leaf-01   Unknown   True     5m
+```
+
+Once the resource is unpaused, the controller runs a full reconcile and
+immediately sets `Ready` back to `True` or `False` based on the observed state.
+
+::: info Why Unknown and not False?
+`False` would imply the resource is broken. `Unknown` is the honest signal:
+the operator has stopped actively verifying the resource, so its current
+state is simply not known.
 :::

internal/paused/paused.go

@@ -43,6 +43,17 @@ func EnsureCondition(ctx context.Context, c client.Client, device *v1alpha1.Devi
 		log.V(4).Info("Reconciliation is paused for this object", "reason", newCondition.Message)
 	}
 
+	// Set Ready=Unknown while paused: the operator is no longer actively
+	// verifying the resource, so its state cannot be determined.
+	if isPaused {
+		conditions.Set(obj, metav1.Condition{
+			Type:    v1alpha1.ReadyCondition,
+			Status:  metav1.ConditionUnknown,
+			Reason:  v1alpha1.PausedReason,
+			Message: "Reconciliation is paused",
+		})
+	}
+
 	// Only do a standalone status patch when pausing. When not paused,
 	// the condition is set in-memory and will be persisted by the normal
 	// reconciliation status update, avoiding an unnecessary extra reconcile.