[FEATURE] GPUQuota validating webhook wiring (#416 story 4)

[Defilan]

Feature Description

Wire the ValidatingWebhookConfiguration for InferenceService that calls the #1094 decision function against live #1093 usage. Story 4 of #416.

Problem Statement

As an operator, I want over-quota InferenceServices rejected at admission with a clear error, and I want the quota to be un-bypassable if the webhook is down.

Proposed Solution

Add internal/webhook/inferenceservice_admit.go:

• Validating webhook on inferenceservices.inference.llmkube.dev (CREATE/UPDATE).
• Resolve applicable GPUQuota(s), read current usage, call quota.Decide(...), return deny with the reason on failure.
• Increment GPUQuota.Status.AdmissionDenials and set LastDenial on rejects.
• failurePolicy: Fail so a webhook outage denies rather than silently allows.
• Register in cmd/ manager; add config/webhook wiring.

Acceptance Criteria (provable in-workspace)

• Envtest with the webhook installed: an in-quota InferenceService is admitted; an over-quota one is rejected with the decision reason.
• Denial counter and LastDenial update on reject.
• make test and make lint pass; cross-arch lint clean.

Dependencies

• Depends on [FEATURE] GPUQuota admission decision function (#416 story 3) #1094 (decision fn) and [FEATURE] GPUQuota status reconciler (#416 story 2) #1093 (usage). Do not start until both are merged.

Priority

• High