refactor: extract dereference/validate pipeline from reconcile_hive

Move external resource resolution (product image, S3 connection, metadata
database, OPA config) into controller::dereference module with its own
error enum. Extract config validation and merging into validate_cluster(),
which produces a ValidatedHiveCluster proving all product-config validation
succeeded before any Kubernetes resources are created.

The validated struct owns the resolved product image and per-role/
per-rolegroup merged configs. Existing build functions are unchanged
and receive their parameters from the validated structs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67