machineops: add provider lifecycle registration

[imiller31]

Summary

• replace the public author-implemented provider interfaces and parallel provider lists with an immutable registration API
• let one provider mix immediate and long-running operation strategies, with operation-local replay safety, replacement bootstrap, and cleanup
• add controller.AddToManager so provider controllers register with controller-runtime without constructing the internal reconciler
• persist long-running provider handles plus immutable provider ID, canonical resource key, and conflict keys on status.targets[]
• migrate the Azure and OCI providers to registrations and narrow provider callbacks to identifiers instead of mutable Kubernetes objects

Provider authoring shape

provider, err := machineops.NewProvider(
    name,
    machineops.WithTargetIdentity(resolveIdentity),
    machineops.WithImmediateOperation(kind, execute, options...),
    machineops.WithLongRunningOperation(kind, machineops.LongRunningFunctions{
        Begin: begin,
        Poll:  poll,
    }, options...),
)

err = machineopscontroller.AddToManager(manager, []*machineops.Provider{provider}, options)

Registered operations replace Supports and optional interface type assertions. The controller owns status transitions, credential resolution, submission classification, crash recovery, polling, conflict serialization, and terminalization.

Safety properties

• long-running targets are snapshotted before submission; polling continues with the captured provider ID even if Machine.spec.providerID changes
• requests are retried only when the provider proves they were not submitted
• accepted operations persist their handle and resume after controller restarts
• unknown submission outcomes are never submitted again automatically
• ordinary poll errors retain the handle and retry; PermanentPollError terminalizes the operation
• immediate operations resume only when explicitly registered with ReplaySafe()
• provider ID handoff still precedes operation-local cleanup

Review follow-ups

• prevent status-update watch events from bypassing the requested polling interval
• serialize conflicts across both immediate and long-running operations
• preserve InProgress when an immediate operation has an unknown outcome so the request is not replayed
• stop declaring Azure host replacement replay-safe without a provider idempotency guarantee
• construct replacement bootstrap data only for initial submission, not while polling
• normalize and truncate provider-supplied condition reasons and messages before persisting them
• measure stalled operations from provider acceptance time instead of object creation time

Validation

• go generate ./api/machina/v1alpha3
• go test ./api/machina/v1alpha3 ./pkg/machineops/... ./internal/machineops/... ./cmd/machine-ops-controller -count=1
• go test -race ./pkg/machineops ./pkg/machineops/controller ./internal/machineops ./internal/machineops/providers/azurevm ./internal/machineops/providers/ociinstance ./cmd/machine-ops-controller -count=1
• go vet ./pkg/machineops/... ./internal/machineops/... ./cmd/machine-ops-controller/...
• golangci-lint run
• ANS provider and client race suites using this branch as a workspace replacement
• ANS emulator smoke test for reboot and reimage, reconstructing the provider between submission and polling

Unrelated repository test failure

go test ./... reaches the existing deterministic TestMaterializeEmbeddedFS failure: the test expects 01-namespace.yaml, which is not materialized in its temporary directory. The failure does not involve MachineOperation code.