Stage 4: TerdutAlertSource

Covers webhook Secret generation/ownership (DESIGN.md §4.5, §7), the
WebhookSecretLost fail-closed condition, and the kind-change
delete-and-recreate rotation path.

Idempotent-create here is deliberately neither adopt-on-409
(Team/service-account) nor list-and-match-by-name (TerdutDeadmanSwitch):
terdut-server shows the webhook key exactly once, at creation, and never
again, so no server-side lookup could ever recover it after a crash.
Instead the generated webhook Secret itself -- written immediately after
the POST, before status is ever touched -- is this CR's only durable
record that a create already succeeded; found with status.integrationID
still unset on a later reconcile, it's read back directly rather than
POSTing a second, orphaned integration. Found missing with
status.integrationID *set* instead, that's the already-designed
WebhookSecretLost case: fail closed, not self-healed, since the key is
genuinely gone and recreating it would rotate a live webhook URL with no
spec change to explain why.

Renaming (PATCH) never touches the key, so it's applied unconditionally
every reconcile, same as the escalation policy's whole-policy PUT. A
spec.kind change is the one case with no in-place update verb at all:
DELETE the old integration, delete the stale webhook Secret, then run the
same create path fresh -- fires a Warning event since this breaks whatever
still sends to the old URL.

Also: fakeTerdutServer grows POST/PATCH/DELETE .../integrations routes
behind a new handleIntegrationSubPath, split out of handleTeamSubPath to
stay under gocyclo's threshold; three goconst-flagged test literals
("does-not-exist", "unready") and one unparam-flagged test helper
parameter (bootstrapReadyTerdutServer's always-"default" namespace) get
shared/removed now that a fourth same-shaped caller made the repetition
concrete enough for the linter to flag.

DESIGN.md §13 gains one honest gap found while grounding this stage, not
introduced by it: no child CRD specially detects a mid-life teamRef
change; all three always resolve spec.teamRef fresh and trust the
already-stored server-side id remains valid there.

make fmt lint test build all clean; internal/controller envtest coverage
holds at 71.6%.

internal/controller/testhelpers_test.go

@@ -26,10 +26,25 @@ const (
 
 	// testRefNotFoundName is a name no TerdutServer/TerdutTeam ever gets
 	// created with -- shared by every "...RefNotFound" test across
-	// terdutteam_controller_test.go, terdutescalationrule_controller_test.go
-	// and terdutdeadmanswitch_controller_test.go, so goconst doesn't flag
-	// three independent copies of the same literal.
+	// terdutteam_controller_test.go, terdutescalationrule_controller_test.go,
+	// terdutdeadmanswitch_controller_test.go and
+	// terdutalertsource_controller_test.go, so goconst doesn't flag four
+	// independent copies of the same literal.
 	testRefNotFoundName = "does-not-exist"
+
+	// testUnreadyDisplayName is the TerdutTeam.spec.displayName every
+	// "...exists but isn't Ready yet" test across the same four files uses
+	// for its deliberately-never-reconciled fixture team, for the same
+	// goconst reason as testRefNotFoundName above.
+	testUnreadyDisplayName = "unready"
+
+	// testOperatorNamespace is every test file's own namespace for both
+	// the operator's generated/credential objects and the CRs under test
+	// -- always "default" in this suite, so bootstrapReadyTerdutServer
+	// below takes no namespace parameter of its own (golangci-lint's
+	// unparam flagged it once a fourth same-valued caller made that
+	// obvious): there's never a second value to pass.
+	testOperatorNamespace = "default"
 )
 
 // bootstrapReadyTerdutServer creates a TerdutServer with a bring-your-own
@@ -37,8 +52,9 @@ const (
 // terdutserver_controller_test.go's own happy-path test exercises directly
 // -- shared here so TerdutTeam's tests (which need a real, Ready
 // TerdutServer to resolve against) don't duplicate it.
-func bootstrapReadyTerdutServer(ctx context.Context, namespace, name, fakeURL string) *terdutv1alpha1.TerdutServer {
+func bootstrapReadyTerdutServer(ctx context.Context, name, fakeURL string) *terdutv1alpha1.TerdutServer {
 	GinkgoHelper()
+	namespace := testOperatorNamespace
 
 	reconciler := &TerdutServerReconciler{
 		Client:            k8sClient,