feat(openstack-sync-operator): manage ironic runbooks using openstack-sync-operator

[haseebsyed12]

Introduces declarative Ironic runbook management through OpenStack Sync.

Sites can now define runbooks as Kubernetes CRs, keep them in the deployment repo, and let the operator converge Ironic state from Git. That makes runbook ownership, updates, pruning, and status reporting part of the same GitOps workflow used for other OpenStack sync resources.

The design keeps shared framework code limited to generic sync mechanics: binding-context handling, credential grouping, status updates, pruning orchestration, and reusable OpenStack pagination. Ironic-specific behavior stays in the runbook plugin, including API microversion requirements, trait matching, owner/public handling, and runbook deletion rules.

What does this change do?

Upgrade impact

• This change requires operator action to upgrade. If checked, add the
  upgrade-impact label and a release note: run scriv create from the
  repository root and describe the required action in the generated
  changelog.d/ file. See RELEASING.md.

Operator action means anything a deployment has to do beyond a normal resync:
deploy repo or values changes, new or removed secrets, enabling or disabling a
component, or a manual one-time step.

[cardoe]

Overall this is a good clean up and improvement. Six inline comments. The two I'd like resolved before this merges are the CRD ownership handoff (data loss on upgrade) and the /owner patch (403 loop that parks every CR in Failed); the rest are smaller.

One thing that didn't fit inline because the files aren't in this diff — stale docs:

• docs/operator-guide/baremetal-ironic-cleanup-runbook.md (around line 502) still points at runbook-crd and runbook-crd/samples as where the CRD and samples live. Those paths still exist on disk after this PR but are no longer rendered by any kustomization, so anyone following the doc edits files that are never applied — the worst kind of stale, since it looks like it worked.
• docs/operator-guide/server-firmware-update.md still describes the legacy shell-operator hooks.

Both should move to components/openstack-sync-plugins/ironic-runbooks/examples/.

For the record, things I specifically checked that are fine:

• The 1.112 microversion floor is right — that's where runbook description and the /runbooks/{id}/traits sub-resource land, and traits are correctly kept out of the create/patch bodies.
• Step payload shape matches RUNBOOK_STEP_SCHEMA.
• The public-transition path is fine; Ironic nulls owner itself when /public is patched.
• Proxy.request defaults to raise_exc=False, so the explicit raise_from_response and NotFoundException handling is doing real work, not dead code.
• Narrowing prune_credentials from _credentials(desired) to _credentials(changed) in framework.py reads as a deliberate tightening and is safe.

All 263 existing tests pass on the branch.

---

Generated by Claude Code