Route SSO configuration through tasks and preserve legacy cleanup

[miki3421]

Summary

• replace the destructive strategic merge patch used by ops config sso disable with targeted JSON Patch operations
• preserve unrelated env, envFrom, volumes, volume mounts, and annotations on the admin-api StatefulSet
• make disable idempotent and avoid an unnecessary explicit rollout restart
• preserve unrecognized local SSO_* configuration keys
• restore the standard task dispatcher for the public ops config sso command
• retain the safe embedded ops -config sso implementation only as a documented legacy compatibility surface
• document the exact Kubernetes resources and values owned by the legacy helper

Root cause

The previous disable implementation sent envFrom: null for the selected admin-api container. Kubernetes therefore removed the complete envFrom list, including ConfigMap and Secret references installed by other components. The enable path also replaced the complete list.

In addition, main.go intercepted ops config sso before normal task dispatch. This made SSO the only ops config subtree whose release-specific orchestration lived in the CLI and required a new CLI release for every change.

The new implementation reads the StatefulSet and adds or removes only exact, prefix-free references to the ConfigMap and Secret managed by ops config sso. JSON Patch test operations guard removals so a concurrent list change cannot make the command remove the wrong entry.

The special public dispatcher is removed. A companion pull request in apache/openserverless-task supplies the real config/sso task on branch 0.9.1. The embedded form remains available only through ops -config sso for backward compatibility.

Behavior

• missing managed ConfigMaps and Secrets remain non-errors through --ignore-not-found
• a repeated disable does not patch or roll out the StatefulSet
• --no-rollout skips rollout waiting and does not issue a restart
• the pod-template change caused by removing envFrom references starts the required Kubernetes rollout without adding a redundant restart annotation

Validation

• go test -count=1 ./...
• go test -race ./config
• go vet ./config
• go build ./cmd/ops
• git diff --check
• Linux arm64 Lima/Kind: original testing/tests/11-sso-mock.sh kind with companion task PR (rc=0)

Tests cover unrelated direct environment variables, unrelated ConfigMap and Secret envFrom references, unrelated volumes and mounts, repeated disable, and the complete enable -> disable -> enable cycle.