refactor: remove PreflightPermissions feature gate and stale pre-auth comments

The PreflightPermissions feature gate is now completely orphaned after
the authorization package removal in the previous commit. Remove the
gate constant and spec definition, and clean up stale pre-auth comments
in the Boxcutter applier.

RBAC watches in main.go are retained as they serve Boxcutter's phase
ordering for bundle RBAC resources.

OPRUN-4631

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pedjak

.claude/TODO-OCPSTRAT-3040.md

@@ -54,11 +54,11 @@ Anyone:      Stream 6 (docs) ← after 4
 - [X] Remove `ServiceAccountValidator` reconciliation step — **OPRUN-4630** `7f5a6843`
 - [X] Remove `getUserInfo()` from Helm applier — **OPRUN-4630** `7f5a6843`
 - [X] Remove `getUserInfo()` from Boxcutter applier — **OPRUN-4630** `7f5a6843`
-- [ ] Remove pre-auth checks from Helm applier — **OPRUN-4631**
-- [ ] Remove pre-auth checks from Boxcutter applier — **OPRUN-4631**
-- [ ] Remove `PreflightPermissions` feature gate from `features.go` — **OPRUN-4631**
+- [X] Remove pre-auth checks from Helm applier — **OPRUN-4631** N/A (PreAuthorizer removed in `9791b717`)
+- [X] Remove pre-auth checks from Boxcutter applier — **OPRUN-4631** N/A (PreAuthorizer removed in `9791b717`)
+- [X] Remove `PreflightPermissions` feature gate from `features.go` — **OPRUN-4631**
 - [ ] Remove `SyntheticPermissions` feature gate from `features.go` — **OPRUN-4632**
-- [ ] Clean up RBAC watches if only needed for pre-auth — **OPRUN-4631**
+- [X] Clean up RBAC watches if only needed for pre-auth — **OPRUN-4631** N/A (RBAC watches serve Boxcutter phase ordering)
 - [X] Rewire `main.go`: remove all SA/synthetic/preflight wiring, always use controller's own SA — **OPRUN-4630** `7f5a6843`
 - [ ] Update all unit + e2e tests — **OPRUN-4630, OPRUN-4631, OPRUN-4632**
 

internal/operator-controller/applier/boxcutter.go

@@ -519,8 +519,7 @@ func (bc *Boxcutter) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.Clust
 		}
 		replaceInlineWithRefs(desiredRevision, packResult)
 
-		// SSA patch (refs-vs-refs). Skip pre-auth — just checking for changes.
-		// createExternalizedRevision runs its own pre-auth if upgrade is needed.
+		// SSA patch (refs-vs-refs) — just checking for changes.
 		err = bc.Client.Apply(ctx, desiredRevision, client.FieldOwner(bc.FieldOwner), client.ForceOwnership)
 
 		// Restore inline objects for preflights + createExternalizedRevision
@@ -611,7 +610,7 @@ func (bc *Boxcutter) createExternalizedRevision(ctx context.Context, ext *ocv1.C
 		}
 	}
 
-	// Step 2: Create COS with refs via SSA (pre-auth already ran above)
+	// Step 2: Create COS with refs via SSA
 	if err := bc.Client.Apply(ctx, desiredRevision, client.FieldOwner(bc.FieldOwner), client.ForceOwnership); err != nil {
 		return fmt.Errorf("creating new Revision: %w", err)
 	}

internal/operator-controller/features/features.go

@@ -11,7 +11,6 @@ import (
 const (
 	// Add new feature gates constants (strings)
 	// Ex: SomeFeature featuregate.Feature = "SomeFeature"
-	PreflightPermissions              featuregate.Feature = "PreflightPermissions"
 	SingleOwnNamespaceInstallSupport  featuregate.Feature = "SingleOwnNamespaceInstallSupport"
 	SyntheticPermissions              featuregate.Feature = "SyntheticPermissions"
 	WebhookProviderCertManager        featuregate.Feature = "WebhookProviderCertManager"
@@ -25,12 +24,6 @@ const (
 var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
 	// Add new feature gate definitions
 	// Ex: SomeFeature: {...}
-	PreflightPermissions: {
-		Default:       false,
-		PreRelease:    featuregate.Alpha,
-		LockToDefault: false,
-	},
-
 	// SingleOwnNamespaceInstallSupport enables support for installing
 	// registry+v1 cluster extensions with single or own namespaces modes
 	// i.e. with a single watch namespace.