fix: report resolve references errors for adopt-or-create

Currently we have been ignoring `ResolveReferences` errors for all
adoptions and readOnly.

Ignoring the error for `adopt-or-create` is an antipattern, since we want
to ensure users are aware of these issues.

In the case of `adopt`, since the spec will fully be rewritten, we would
not need to resolve references at all.

Author: michaelhtm

pkg/runtime/reconciler.go

@@ -427,8 +427,8 @@ func (r *resourceReconciler) Sync(
 	rlog.Enter("rm.ResolveReferences")
 	resolved, hasReferences, err := rm.ResolveReferences(ctx, r.apiReader, desired)
 	rlog.Exit("rm.ResolveReferences", err)
-	// TODO (michaelhtm): should we fail here for `adopt-or-create` adoption policy?
-	if err != nil && !needAdoption && !isReadOnly {
+	// TODO (michaelhtm): ignore error only for `adopt` or `read-only`
+	if err != nil && (adoptionPolicy == "" || adoptionPolicy == AdoptionPolicy_AdoptOrCreate) && !isReadOnly {
 		return ackcondition.WithReferencesResolvedCondition(desired, err), err
 	}
 	if hasReferences {