refactor: extract dereference/validate pipeline from reconcile_hive (#707)

* refactor: extract dereference/validate pipeline from reconcile_hive

Move external resource resolution (product image, S3 connection, metadata
database, OPA config) into controller::dereference module with its own
error enum. Extract config validation and merging into validate_cluster(),
which produces a ValidatedHiveCluster proving all product-config validation
succeeded before any Kubernetes resources are created.

The validated struct owns the resolved product image and per-role/
per-rolegroup merged configs. Existing build functions are unchanged
and receive their parameters from the validated structs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: extract validate_cluster into controller::validate module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: align error variant naming with airflow and hbase operators

Rename FailedToResolveResourceConfig to FailedToResolveConfig and
fix OPA error display string to match the convention used across
all three dereference/validate extraction PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: move product image resolution from dereference to validate

Image resolution is a pure computation, not an I/O dereference, so it
belongs in validate_cluster alongside the other config validation. This
aligns with the pattern used by the trino and airflow operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* changelog

* Update rust/operator-binary/src/controller.rs

Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

* assume single role in ValidatedHiveCluster

* move db connection details from dereferenced to the controller and remove derives where they do not exist on the upstream type

* move validated cluster to the controller which will be the central dependency for subsequent steps

* replace parameter with constant

* replace parameter with compile-time value; rename function

* pass dereferenced fields through to validation

* extend assert step to increase test coverage by checking most generated resources

* remove securityContext from assert (might not work on Openshift)

* nix update

* pass dereferenced struct rather than each field

* remove timestmap from assert

* move related structs togetherin controller

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

Author: 3 people

CHANGELOG.md

@@ -17,11 +17,13 @@ All notable changes to this project will be documented in this file.
   This means you need to replace your simple database connection string with a typed struct.
   This struct is consistent between different CRDs, so that you can easily copy/paste it between stacklets.
   Read on the [Hive database documentation](https://docs.stackable.tech/home/nightly/hive/usage-guide/database-driver) for details ([#674]).
+- Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#707]).
 
 [#674]: https://github.com/stackabletech/hive-operator/pull/674
 [#693]: https://github.com/stackabletech/hive-operator/pull/693
 [#695]: https://github.com/stackabletech/hive-operator/pull/695
 [#702]: https://github.com/stackabletech/hive-operator/pull/702
+[#707]: https://github.com/stackabletech/hive-operator/pull/707
 
 ## [26.3.0] - 2026-03-16