feat(controller): add GPUQuota validating webhook for InferenceService

[Defilan]

What

Adds the GPUQuota validating webhook for InferenceService (internal/controller/inferenceservice_quota_webhook.go), the generated config/webhook manifest and RBAC, and fake-client unit tests. This is the enforcement half of the multi-tenancy epic (#416): it rejects an InferenceService whose admission would exceed an applicable GPUQuota.

InferenceServiceQuotaValidator implements admission.Validator[*InferenceService] (create + update; delete is a no-op). For each GPUQuota whose scope covers the incoming InferenceService's namespace, it computes current usage, builds the incoming request, calls the pure quota.Decide (#1094), and denies with the returned reason if any quota rejects. failurePolicy: fail, sideEffects: None.

Why

Fixes #1095

Types (#1092) and the decision function (#1094) are merged; this is the piece that actually enforces a quota at admission. It calls Decide so the allow/deny rules stay in one place.

How

Usage is computed fresh at admission (list InferenceServices in the quota's scope, sum resources.gpu * replicas, excluding the incoming object so an update does not double-count), so the decision does not depend on the status reconciler (#1117) having run. Selector scope uses metav1.LabelSelectorAsSelector (honors matchLabels + matchExpressions).

Documented deferrals (consistent with the rest of the epic):

• costBudgetBreached is always false for now: InferCost TokenBudget integration is a follow-up. Commented at the call site.
• The webhook does not update GPUQuota.Status.AdmissionDenials: a validating webhook is sideEffects: None, so the denial counter is deferred (a metric or a reconciler-observed counter). Commented.
• Incoming.VRAMBytes is 0: InferenceService exposes no VRAM field (mirrors [FEATURE] GPUQuota status reconciler (#416 story 2) #1093).

Testing / verification

Verified locally in an isolated worktree:

• go build ./..., go vet ./internal/controller/... ./cmd/... clean
• go test ./internal/controller/ fake-client unit tests pass: in-quota admit; over-gpuCount deny (with reason); priority-floor deny; a quota that does not cover the namespace is ignored; an update that stays within quota is admitted; and gpu:2 * replicas:3 = 6 counts correctly
• make manifests generate chart-crds then git status stable: the webhook manifest and RBAC role are regenerated and in sync
• gofmt clean; golangci-lint --new-from-rev 0 new issues
• the full controller envtest suite (make test) passed in the clean-room gate

Notes for the reviewer

• The generated config/webhook/manifests.yaml ships the ValidatingWebhookConfiguration, but activation is gated by the Helm multitenancy.enabled toggle in [FEATURE] Helm multitenancy toggle + tenant RBAC (#416 story 5) #1096 (default off), so this PR alone does not intercept admission until that toggle lands.
• Boundary semantics follow [FEATURE] GPUQuota admission decision function (#416 story 3) #1094: the cap is inclusive (deny only when current + incoming > cap), so exactly-at-cap is admitted.

AI assistance disclosure

Assisted-by: Foreman, the project's local agentic coding harness (coder model qwopus3.6-35B on-prem). Foreman generated the webhook and tests; a review pass I directed found that three of its own "over-gpuCount" tests asserted a deny at exactly-at-cap (which Decide correctly admits) and that gpuCount ignored replicas. Those were fed back as a revision cycle that corrected the tests and the replicas math and added a gpu*replicas case. I reviewed the result and ran the verification above. I own this change and the review conversation; per AGENTS.md the commit carries no attribution trailer and the DCO sign-off is mine.

Checklist

• Tests added/updated
• Tests pass locally (go test ./internal/controller/, incl. the full envtest suite in the gate)
• Lint clean for this change (golangci-lint --new-from-rev 0 new issues; gofmt clean)
• Commit messages follow conventional commits
• Commit is signed off (git commit -s) per DCO
• AI assistance is disclosed above
• Documentation updated (n/a: internal webhook; user-facing docs land with the Helm toggle in [FEATURE] Helm multitenancy toggle + tenant RBAC (#416 story 5) #1096)

[codecov]

Codecov Report

❌ Patch coverage is 62.33766% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ernal/controller/inferenceservice_quota_webhook.go	65.75%	17 Missing and 8 partials ⚠️
cmd/main.go	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!