Replace ReferencingServers with structured ReferencingWorkloads on MCPOIDCConfig

[ChrisJBurns]

Summary

• RFC-0023 specifies a structured referencingWorkloads list with kind and name fields on shared configuration CRD status, rather than plain []string with string prefix conventions. This introduces a WorkloadReference type and migrates MCPOIDCConfig from ReferencingServers []string to ReferencingWorkloads []WorkloadReference.
• The MCPServer controller and MCPOIDCConfig controller are updated to build, compare, and track structured WorkloadReference entries throughout: reference tracking, deletion protection, watch handlers, and status updates.
• The WorkloadReference type is reusable by MCPToolConfig, MCPTelemetryConfig, and MCPExternalAuthConfig in follow-up work (Migrate ReferencingServers to ReferencingWorkloads on remaining CRDs #4491).

Type of change

• Refactoring (no behavior change)

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
api/v1alpha1/mcpoidcconfig_types.go	Add WorkloadReference struct; rename ReferencingServers []string → ReferencingWorkloads []WorkloadReference
controllers/mcpoidcconfig_controller.go	Rename findReferencingServers → findReferencingWorkloads; update watch handler, deletion handling, status updates
controllers/mcpserver_controller.go	Rename updateOIDCConfigReferencingServers → updateOIDCConfigReferencingWorkloads; use WorkloadReference{Kind: "MCPServer"}
controllers/mcpserver_oidcconfig_test.go	Update unit tests for WorkloadReference
test-integration/mcp-oidc-config/mcpoidcconfig_mcpserver_integration_test.go	Update integration tests for WorkloadReference
test-integration/mcp-oidc-config/mcpoidcconfig_controller_integration_test.go	Extract conditionTypeValid constant

Does this introduce a user-facing change?

Yes — the MCPOIDCConfig status field referencingServers (plain string array) is replaced with referencingWorkloads (structured array with kind and name fields). This is a status-only change; the spec API is unchanged.

Special notes for reviewers

• This is PR 1 of 2. PR 2 (VirtualMCPServer wiring to MCPOIDCConfig) will be stacked on this branch.
• The WorkloadReference type is defined with an enum validation for Kind (MCPServer, VirtualMCPServer, MCPRemoteProxy) to support all current workload types.
• Follow-up issue Migrate ReferencingServers to ReferencingWorkloads on remaining CRDs #4491 tracks the same migration for MCPToolConfig, MCPTelemetryConfig, and MCPExternalAuthConfig.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 65.38462% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.35%. Comparing base (26f6e1e) to head (1f94b73).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...v-operator/controllers/mcpoidcconfig_controller.go	64.70%	5 Missing and 1 partial ⚠️
...d/thv-operator/controllers/mcpserver_controller.go	66.66%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4492      +/-   ##
==========================================
+ Coverage   69.31%   69.35%   +0.03%     
==========================================
  Files         502      502              
  Lines       51632    51635       +3     
==========================================
+ Hits        35791    35811      +20     
+ Misses      13075    13058      -17     
  Partials     2766     2766              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.