fix(#4770): Fix status-only startup without initializing the constraint client

[7487]

What this PR does / why we need it

HasValidationOperations currently classifies status as policy validation. A status-only process therefore constructs a constraint client without an audit or webhook enforcement point and fails during startup. It also starts validation ingestion controllers that status aggregation does not need.

This change:

• scopes validation operations to audit and webhook;
• registers only the Constraint and ConstraintTemplate status aggregators in status-only mode;
• lets the Constraint status aggregator read from the API-backed manager client when there is no validation dynamic watch;
• keeps the existing dynamic-watch path for audit/webhook combinations; and
• adds the root package to native test targets so status-only controller setup remains covered.

Verification

• TDD red phase: TestHasValidationOperations/status_only failed before the predicate fix.
• go test ./pkg/operations ./pkg/controller/constraintstatus ./pkg/controller/constrainttemplate ./pkg/controller/constrainttemplatestatus
• go test . -run TestSetupControllersStatusOnly with Kubernetes 1.33 envtest assets
• make native-test
• make native-race-test
• golangci-lint v2.9.0 run . ./pkg/operations/... ./pkg/controller/constraintstatus/... ./pkg/controller/constrainttemplate/... (0 issues)
• go vet ./...
• go build ./...
• direct manager and gator binary builds with the repository's version ldflag

Fixes #4770

[linux-foundation-easycla]

• ❌ - login: @7487 / name: 7487. The commit (f352b6d) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.