fix(operator): defer workflow reconciliation until runner is ready

[ambient-code]

Summary

• Remove premature workflow reconciliation from the Pending phase handler — reconcileActiveWorkflowWithPatch() was called before the runner pod existed, causing DNS failures that were silently discarded via _ =
• Add workflow retry in Running phase — new NeedsWorkflowReconciliation() check detects WorkflowReconciled != True and triggers ReconcileWorkflow() with 5-second backoff requeue
• Fix swallowed errors — replace _ = statusPatch.Apply() with proper error logging in ReconcileSpecChanges, and add requeue on spec reconciliation failure

Root Cause

Three-part failure chain (as described in #1486):

1. reconcileActiveWorkflowWithPatch() attempted HTTP POST to runner before pod existed → DNS error
2. Error silently discarded (_ = reconcileActiveWorkflowWithPatch(...))
3. observedGeneration set despite failure, preventing Running phase from retrying

Changes

File	What
handlers/sessions.go	Remove reconcileActiveWorkflowWithPatch() call from Pending phase; log repo reconciliation errors
handlers/reconciler.go	Add ReconcileWorkflow() for targeted workflow retry; fix _ = statusPatch.Apply()
handlers/helpers.go	Add NeedsWorkflowReconciliation() to detect unreconciled workflows
handlers/helpers_test.go	6 test cases for NeedsWorkflowReconciliation
controller/reconcile_phases.go	Add workflow retry check in reconcileRunning(); requeue on ReconcileSpecChanges failure

Test plan

• go build ./... passes
• go vet ./... passes
• TestNeedsWorkflowReconciliation — 6 cases covering: no workflow, empty gitUrl, no conditions, True condition, False condition, missing condition
• Pre-existing handler tests still pass (registry tests fail due to missing config file — pre-existing)
• Deploy to dev cluster and create session with activeWorkflow — verify WorkflowReconciled becomes True
• Verify sessions without workflows are unaffected

Closes #1486

🤖 Generated with Claude Code

---

🤖 Ambient Session

[netlify]

✅ Deploy Preview for cheerful-kitten-f556a0 canceled.

Name	Link
🔨 Latest commit	fed6387
🔍 Latest deploy log	https://app.netlify.com/projects/cheerful-kitten-f556a0/deploys/69f34e76a0ff5c0008ef54f1

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-30 13:14 UTC · Rule: default
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-04-30 13:15 UTC · at fed63879c23a752225dbdfaa6382f0ce7647d252 · squash

This pull request spent 15 seconds in the queue, including 2 seconds running CI.

Required conditions to merge