Add envtest suite for StorageVersionMigrator controller

Seven table-driven scenarios exercising the reconciler against a real
kube-apiserver + etcd via envtest:

  - noop when storedVersions is already [storageVersion]
  - happy path: [v1alpha1,v1beta1] -> [v1beta1] with CRs re-stored
  - foreign-group CRDs are skipped
  - unlabelled toolhive CRDs are skipped
  - fallback to main-resource SSA when /status is absent
  - pagination across the continue-token loop (verified via a counting
    APIReader wrapper since metadata-only SSAs leave no managedFields
    fingerprint to assert on)
  - partial failure leaves storedVersions untouched (failure injected
    via a client wrapper that fails Apply for one specific CR key)

Each test builds its own CRD fixture and calls Reconcile directly; the
suite does not start a manager so tests are deterministic and free from
races with a background controller. Runs via `task operator-test-integration`
alongside the existing virtualmcp suite.

Part of #4969.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ChrisJBurns