feat(api,operator): MCPAccessPolicy CRD for observable policy state

## Summary

Gateway policy currently lives in a rendered ConfigMap — invisible to `kubectl describe` in any meaningful way. Add an `MCPAccessPolicy` CRD so the active policy state is first-class Kubernetes state.

## Desired UX

```
kubectl get mcpaccesspolicy -n mcp-servers
NAME REVISION GRANTS SESSIONS AGE
workspace-assistant sha256:a1b2c3 3 12 5m

kubectl describe mcpaccesspolicy workspace-assistant
Status:
Revision: sha256:a1b2c3
Activated At: 2026-06-11T00:00:00Z
Grant Count: 3
Session Count: 12
Validation Error:
Conditions:
Type: PolicyValid
Status: True
```

## Design

`MCPAccessPolicy` is **operator-managed** — users never write to it directly. The operator creates/updates it alongside the existing ConfigMap write.

- **Spec**: intentionally empty (all state is derived from `MCPAccessGrant`/`MCPAgentSession`)
- **Status**: `revision`, `activatedAt`, `grantCount`, `sessionCount`, `validationError`, `conditions`
- **Short name**: `mapa`
- **Owner reference**: set to the parent `MCPServer`

Inspired by Linkerd's `AuthorizationPolicy` CRD — policy as inspectable Kubernetes state rather than an opaque ConfigMap.

## Scope

- `api/v1alpha1/mcpaccesspolicy_types.go` — new types + kubebuilder markers
- `api/v1alpha1/zz_generated.deepcopy.go` — DeepCopy methods
- `api/v1alpha1/groupversion_info.go` — register new types
- `config/crd/bases/mcpruntime.org_mcpaccesspolicies.yaml` — CRD manifest
- `internal/operator/policy.go` — reconcile MCPAccessPolicy alongside ConfigMap
- RBAC markers for the operator