Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

config/samples/kustomization.yaml

@@ -2,4 +2,6 @@
 resources:
 - terdut_v1alpha1_terdutserver.yaml
 - terdut_v1alpha1_terdutteam.yaml
+- terdut_v1alpha1_terdutescalationrule.yaml
+- terdut_v1alpha1_terdutdeadmanswitch.yaml
 # +kubebuilder:scaffold:manifestskustomizesamples

config/samples/terdut_v1alpha1_terdutdeadmanswitch.yaml

@@ -0,0 +1,15 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutDeadmanSwitch
+metadata:
+  labels:
+    app.kubernetes.io/name: terdut-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: terdutdeadmanswitch-sample
+spec:
+  teamRef:
+    name: terdutteam-sample
+  # name is optional -- left empty, terdut-server derives it from matcher's
+  # own canonical form (DESIGN.md §4.4).
+  matcher: "alertname=Watchdog"
+  timeout: 15m
+  severity: critical

config/samples/terdut_v1alpha1_terdutescalationrule.yaml

@@ -0,0 +1,25 @@
+apiVersion: terdut.ryuvia.com/v1alpha1
+kind: TerdutEscalationRule
+metadata:
+  labels:
+    app.kubernetes.io/name: terdut-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: terdutescalationrule-sample
+spec:
+  # One per team (DESIGN.md §4.3) -- a second TerdutEscalationRule naming
+  # the same teamRef would simply clobber this one every reconcile, since
+  # there's no admission-time check for it in v1.
+  teamRef:
+    name: terdutteam-sample
+  repeatCount: 2
+  fallbackTopic: platform-fallback
+  levels:
+    # username is required iff kind is "user", and rejected otherwise --
+    # enforced at apply time via CEL (api/v1alpha1/terdutescalationrule_types.go).
+    - timeout: 5m
+      targets:
+        - kind: user
+          username: alice
+    - timeout: 10m
+      targets:
+        - kind: oncall