fix: handle config-reloader secret watch tombstones

[immanuwell]

this fixes a small crash in config-reloader.

when the secret informer misses a delete event and catches it on relist, client-go can send cache.DeletedFinalStateUnknown to DeleteFunc. current code does obj.(*corev1.Secret) and panics, so the reloader falls over.

fix is pretty small:

• unwrap tombstones before queueing secret events
• keep the normal *corev1.Secret path the same
• add a unit test for raw secret and tombstone payloads

repro:

1. run the secret informer in cmd/config-reloader
2. let the watch close and miss a Secret delete
3. on the next relist, client-go delivers cache.DeletedFinalStateUnknown
4. current DeleteFunc type asserts to *corev1.Secret and crashes

checks:

• go test ./cmd/config-reloader/...
• make test

---

Summary by cubic

Fix a crash in config-reloader when the secret watcher receives tombstone events. We now unwrap cache.DeletedFinalStateUnknown instead of asserting directly to *corev1.Secret.

• Bug Fixes
  • Added secretFromEvent to handle *corev1.Secret and tombstones (value and pointer) from client-go.
  • Updated Add/Update/Delete handlers to use secretFromEvent and log unexpected types.
  • Added unit tests for raw secret, tombstone variants, and unexpected types.
  • Updated docs/CHANGELOG.md to note the fix.

^{Written for commit afa7bed. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[AndrewChubatiuk]

@immanuwell thanks for contribution!