Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

internal/controller/terdutteam_controller_test.go

@@ -86,7 +86,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 	readyCondition := func(ctx context.Context) metav1.Condition {
 		team := &terdutv1alpha1.TerdutTeam{}
 		Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-		c := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionTeamReady)
+		c := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionReady)
 		Expect(c).NotTo(BeNil())
 		return *c
 	}
@@ -120,7 +120,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 
 	Describe("waiting on the referenced TerdutServer", func() {
 		It("reports ServerRefNotFound when the TerdutServer doesn't exist", func(ctx SpecContext) {
-			createTeam(ctx, "orphan", terdutv1alpha1.TerdutServerRef{Name: "does-not-exist"})
+			createTeam(ctx, "orphan", terdutv1alpha1.TerdutServerRef{Name: testRefNotFoundName})
 			reconcileOnce(ctx) // finalizer
 			reconcileOnce(ctx)
 
@@ -175,7 +175,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			Expect(k8sClient.Get(ctx, crossKey, team)).To(Succeed())
-			cond := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionTeamReady)
+			cond := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionReady)
 			Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonRefNotPermitted))
 		})
 
@@ -201,7 +201,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			Expect(k8sClient.Get(ctx, crossKey, team)).To(Succeed())
-			cond := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionTeamReady)
+			cond := meta.FindStatusCondition(team.Status.Conditions, terdutv1alpha1.ConditionReady)
 			// Past the gate: Adopted (the fake server has no reason to
 			// reject this), definitely not RefNotPermitted.
 			Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonTeamAdopted))