Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

internal/controller/testhelpers_test.go

@@ -23,6 +23,13 @@ const (
 	testImageRepo = "example.invalid/terdut-server"
 	testImageTag  = "test"
 	testDSN       = "postgres://terdut@test-postgres:5432/terdut?sslmode=require"
+
+	// testRefNotFoundName is a name no TerdutServer/TerdutTeam ever gets
+	// created with -- shared by every "...RefNotFound" test across
+	// terdutteam_controller_test.go, terdutescalationrule_controller_test.go
+	// and terdutdeadmanswitch_controller_test.go, so goconst doesn't flag
+	// three independent copies of the same literal.
+	testRefNotFoundName = "does-not-exist"
 )
 
 // bootstrapReadyTerdutServer creates a TerdutServer with a bring-your-own
@@ -70,6 +77,41 @@ func bootstrapReadyTerdutServer(ctx context.Context, namespace, name, fakeURL st
 	return srv
 }
 
+// readyTerdutTeam creates a TerdutTeam under srv (an already-Ready
+// TerdutServer, e.g. from bootstrapReadyTerdutServer) and drives it to
+// Ready against fakeURL -- shared by TerdutEscalationRule's and
+// TerdutDeadmanSwitch's own tests, which both just need a resolvable
+// teamRef (DESIGN.md §5), not TerdutTeam's own behavior.
+func readyTerdutTeam(ctx context.Context, namespace, name string, srv *terdutv1alpha1.TerdutServer, fakeURL string) *terdutv1alpha1.TerdutTeam {
+	GinkgoHelper()
+
+	reconciler := &TerdutTeamReconciler{
+		Client:            k8sClient,
+		Scheme:            k8sClient.Scheme(),
+		OperatorNamespace: namespace,
+		NewClient:         func(string) *tdclient.Client { return tdclient.New(fakeURL) },
+	}
+	objKey := types.NamespacedName{Name: name, Namespace: namespace}
+
+	team := &terdutv1alpha1.TerdutTeam{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
+		Spec: terdutv1alpha1.TerdutTeamSpec{
+			ServerRef:   terdutv1alpha1.TerdutServerRef{Name: srv.Name},
+			DisplayName: name,
+		},
+	}
+	Expect(k8sClient.Create(ctx, team)).To(Succeed())
+
+	_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // finalizer
+	Expect(err).NotTo(HaveOccurred())
+	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // create+mint+apply
+	Expect(err).NotTo(HaveOccurred())
+
+	Expect(k8sClient.Get(ctx, objKey, team)).To(Succeed())
+	Expect(team.Status.CredentialsSecretRef).NotTo(BeNil(), "test setup: TerdutTeam %s/%s did not reach Ready", namespace, name)
+	return team
+}
+
 // uniqueNameCounter backs uniqueName. GinkgoRandomSeed()/GinkgoParallelProcess()
 // are constants for the whole suite run, not per-spec -- an earlier version
 // of this helper used them and collided across every spec that called it