add a Kubernetes informer-based watcher for CRD policy updates
Add a watcher implementation that reacts to CRD changes and keeps in-memory Casbin state up to date without periodic polling. This watcher should be compatible with Casbin’s watcher mechanism so it can be attached to an enforcer and trigger safe reload or incremental updates when roles or role mappings change in the cluster. The implementation should rely on Kubernetes informers (or equivalent watch primitives) and handle reconnects and resource version drift gracefully.
The watcher should be concurrency-safe when used with SyncedEnforcer, and tests should validate that create/update/delete events result in the expected policy changes being reflected in enforcement decisions. The goal is that a GitOps-applied CRD update becomes effective quickly across running instances with predictable behavior.