docs(plan): note Phase 10.1 controllers scaffold landed (stubs only)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -527,7 +527,7 @@ and per-object configuration lives in typed Spec / Status fields.
 
 ### 10.1 — Satellite as a controller-runtime controller
 
-- [ ] New `pkg/satellite/controllers/` package wired into the satellite agent. Reconcilers for Resource (filtered by `Spec.NodeName == cfg.NodeName`), ResourceDefinition (parent lookup, no own reconcile), Snapshot (filtered by `Spec.Nodes ∋ cfg.NodeName`), StoragePool (filtered by `Spec.NodeName == cfg.NodeName`).
+- [~] `pkg/satellite/controllers/` package scaffold (2026-05-10). All four reconcilers (Resource / ResourceDefinition / Snapshot / StoragePool) defined with the right node-name predicates (or membership filter for Snapshot) + `NewManager` builder that wires them onto a controller-runtime manager. Reconciler bodies are stubs (Get + log + return) — subsequent commits fill in the apply path by delegating to `Config.Apply` (the existing `pkg/satellite.Reconciler`). NOT yet wired into `agent.Run` — gRPC server stays primary until Phase 10.6 retires it.
 - [ ] Resource reconciler on satellite replaces the gRPC `ApplyResources` consumer with a native CRD watch. On reconcile: read Resource Spec + parent RD + peers (List by RD-name) + Node info + effective DRBD options (resolver re-runs satellite-side, reading RG via apiserver) → drive `pkg/satellite/reconciler.applyOne` (existing logic, lifted out from the gRPC handler).
 - [ ] DeleteResource flow: on Resource with non-zero `DeletionTimestamp` + the satellite's own finalizer, satellite runs the existing teardown (`drbdadm down` → `DeleteVolume` → `rm .res` → `cryptsetup luksClose`) then strips its own finalizer. Today's controller-side `runDelete` (`internal/controller.ResourceReconciler.runDelete`) goes away — finalizer ownership transfers to the satellite.
 - [x] ServiceAccount + RBAC manifests (2026-05-10). `config/rbac/satellite_role.yaml` defines the ClusterRole + ServiceAccount + binding the satellite needs once Phase 10.1 promotes it to a controller-runtime manager: read-only on RG/RD/Node/Snapshot/ControllerConfig; read+write on Resource (own finalizer); write on `*/status` subresources via SSA from Phase 10.2; full CRUD on PhysicalDevice (discovery+delete-on-attach); read on Secrets in the controller namespace; emit Events; per-node leader-election Leases. Wired into `config/rbac/kustomization.yaml`. Dormant until the satellite-as-controller-runtime code lands.