fix(webhook): remove shadowed err variable and add routes volume override test

**Shadowed variable fix:**
- Remove `var err error` inside agentRuntime block (line 1363)
- Use the function's named return parameter directly
- Prevents fragile error handling where marshal failure might not propagate

**Test coverage:**
- Add TestOverrideRoutesConfigMapInVolumes following the pattern of
  TestOverrideEnvoyConfigMapInVolumes
- Verifies volume swap without mutation
- Checks that Optional is set to false for per-agent routes

Addresses review comments from #517

Assisted-By: Claude Code
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

operator/internal/webhook/injector/pod_mutator.go

@@ -1360,7 +1360,6 @@ func (m *PodMutator) ensurePerAgentConfigMap(
 			routes = append(routes, route)
 		}
 
-		var err error
 		routesData, err = yaml.Marshal(routes)
 		if err != nil {
 			return "", "", fmt.Errorf("failed to marshal routes for %s/%s: %w", namespace, crName, err)

operator/internal/webhook/injector/volume_builder_test.go

@@ -246,3 +246,77 @@ func TestOverrideEnvoyConfigMapInVolumes(t *testing.T) {
 		})
 	}
 }
+
+// TestOverrideRoutesConfigMapInVolumes verifies the per-agent routes override:
+// when AgentRuntime has spec.auth.outbound routes, the authproxy-routes volume
+// is redirected to authbridge-routes-<crName> without mutating the input.
+func TestOverrideRoutesConfigMapInVolumes(t *testing.T) {
+	tests := []struct {
+		name    string
+		volumes func() []corev1.Volume
+		newCM   string
+		found   bool
+	}{
+		{
+			name: "volume found, name swapped",
+			volumes: func() []corev1.Volume {
+				return BuildRequiredVolumes()
+			},
+			newCM: "authbridge-routes-my-agent",
+			found: true,
+		},
+		{
+			name: "no authproxy-routes volume, list unchanged",
+			volumes: func() []corev1.Volume {
+				return []corev1.Volume{{
+					Name:         "shared-data",
+					VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
+				}}
+			},
+			newCM: "authbridge-routes-my-agent",
+			found: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			original := tt.volumes()
+			overridden := overrideRoutesConfigMapInVolumes(original, tt.newCM)
+
+			// Original must not be mutated
+			for _, v := range original {
+				if v.Name == "authproxy-routes" && v.ConfigMap != nil {
+					if v.ConfigMap.Name != AuthproxyRoutesConfigMapName {
+						t.Errorf("original was mutated: got %q", v.ConfigMap.Name)
+					}
+				}
+			}
+
+			// Output length matches input length
+			if len(overridden) != len(original) {
+				t.Fatalf("overridden length = %d, want %d", len(overridden), len(original))
+			}
+
+			// Find-and-swap behavior
+			swappedFound := false
+			for _, v := range overridden {
+				if v.Name == "authproxy-routes" && v.ConfigMap != nil {
+					swappedFound = true
+					if v.ConfigMap.Name != tt.newCM {
+						t.Errorf("authproxy-routes CM name = %q, want %q", v.ConfigMap.Name, tt.newCM)
+					}
+					// Verify Optional is set to false for per-agent routes
+					if v.ConfigMap.Optional == nil || *v.ConfigMap.Optional != false {
+						t.Errorf("authproxy-routes Optional should be false when overridden")
+					}
+				}
+			}
+			if tt.found && !swappedFound {
+				t.Fatal("expected authproxy-routes volume in overridden but didn't find it")
+			}
+			if !tt.found && swappedFound {
+				t.Fatal("authproxy-routes volume should not have been added")
+			}
+		})
+	}
+}