Separate Config process exclusions from validation data-sync dependencies

[JaydipGabani]

Parent issue: #3964
Related operation cleanup: #4051
Related focused tasks: #4770, #4771, #4772, #4773

Describe the solution you'd like

Gatekeeper should initialize the watch manager, cache manager, sync controller, and expectations pruner only for operations that require validation data synchronization.

Today setupControllers always creates the cache-manager registrar, sync metrics cache, cache manager, and expectations pruner. controller.AddToManager always registers the cache manager runnable and sync controller. The Config controller also always starts and requires the cache manager.

#4423 made this stack tolerate a missing constraint client by installing a no-op CFDataClient. That was necessary for the mutation-webhook startup fix, but it leaves mutation-only and unrelated operation pods carrying validation data-sync infrastructure they do not use.

The Config resource has two different responsibilities that need separate dependency decisions:

• Updating process exclusions used by admission/audit paths.
• Managing syncOnly watches and copying referential data into the constraint client.

Generate may additionally need Config change events when VAP enforcement-scope synchronization is enabled.

Suggested scope:

• Introduce explicit capability predicates for Config reconciliation, process exclusions, validation data sync, and generate/VAP scope notifications.
• Separate process-exclusion updates from the cache-manager-backed syncOnly path so mutation-webhook-only operation does not require a no-op validation data client or unnecessary data watches.
• Register the cache manager, sync controller, registrar, and expectations pruner only when validation data sync is required.
• Keep every registered controller's required dependencies non-nil and fail setup loudly for an invalid dependency plan.
• Preserve readiness and ConfigPodStatus behavior for each operation.

Acceptance criteria:

• Audit and validating-webhook operation sets retain Config syncOnly behavior and referential data synchronization.
• Mutation-webhook-only retains Config process exclusions without starting validation data-sync watches or writing data to a no-op constraint client.
• Generate retains Config-triggered VAP scope reconciliation when configured.
• Status-only, mutation-status-only, and other operation sets that need neither Config nor data sync do not start the cache manager, sync controller, or expectations pruner.
• Default all-operations behavior remains unchanged.
• Focused tests cover each capability combination and fail when unconditional shared-stack registration is restored.

Environment:

• Gatekeeper version: current master
• Kubernetes version: not version-specific