feat(controller): clear the ReferencedData gate when companions land on the cell

The cell InstanceReconciler now owns the second half of the gate contract:
it removes the ReferencedData scheduling gate once every companion the
resolver promised has arrived, letting the provider launch the instance.

- The expected-companion manifest annotation on the owner WorkloadDeployment
  is checked against labeled companions actually present in the namespace —
  a pure set-membership test, no name recomputation on the cell.
- Progress is reflected on the Instance's ReferencedDataReady condition:
  AwaitingPropagation while companions are in flight, Ready when complete.
  Terminal resolver verdicts (source not found, unauthorized, too large) are
  promoted from the WD's error annotation — the only signal that crosses the
  federation boundary — so users see the root cause on the Instance instead
  of an indefinite wait.
- Companion Create events in a namespace re-queue that namespace's
  instances, so gates clear promptly on arrival rather than on the next
  periodic resync.
- Gate-clearing latency, expected/present companion counts, condition
  transitions, and cleared events are all observable; the gate-start
  timestamp annotation feeds the wait-duration histogram.

Quota and ReferencedData gate removal are unified in a single
reconcileSchedulingGates pass so one status write covers both.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: scotwells