[Bug]: Enforce presence immutability for optional JobSpec fields

Start with ADR-079 Decision 6 and the field definitions in api/v1alpha1/job_types.go, then inspect Workflow's JobTemplateSpec.Spec in api/v1alpha1/workflow_types.go. Run or extend envtest admission coverage for direct Jobs and Workflow templates, including add, remove, and value-change transitions when fields are absent or present. Done includes reviewed regenerated CRDs and generated code plus the documented compatibility effect.

Prerequisites

• I searched existing issues
• I can reproduce this issue

Code of Conduct

• I agree to follow the project's Code of Conduct

Bug Description

JobSpec.nodeHealthMonitor, goodputMeasurement, and bandwidthMeasurement are documented and marked as immutable, but each optional field has only a field-level CEL rule:

// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="... is immutable"

CEL transition rules scoped to an optional field are not evaluated when that field changes between absent and present. A direct Job, or a Workflow carrying the same JobSpec through spec.jobTemplate.spec, can therefore add or remove these fields after creation even though changing an existing value is rejected.

This leaves two meanings of "immutable" in the same CRD. ADR-079 identifies the complete pattern for new optional immutable fields: a parent-level presence rule plus field-level equality.

Expected behavior

For all three fields, admission rejects:

• absent to present;
• present to absent; and
• changes to a present value.

The rule must apply to direct Jobs and propagate through JobTemplateSpec.Spec to Workflows.

Acceptance Criteria

• Add parent-level presence-invariance rules for nodeHealthMonitor, goodputMeasurement, and bandwidthMeasurement on JobSpec.
• Keep the existing field-level equality rules.
• Add envtest admission coverage for add, remove, and value-change transitions on direct Jobs and Workflow Job templates.
• Cover existing objects whose stored specs omit the optional fields.
• Regenerate and review the affected CRDs and generated code.
• Document the compatibility effect: objects created without one of these fields cannot add it later.

Component

API / CRDs

Steps to Reproduce

1. Create a Job without one of the three optional fields.
2. Update the Job to add the field.
3. Observe that API admission accepts the update despite the field's immutable marker.
4. Repeat by removing a present field and through Workflow.spec.jobTemplate.spec.

Environment

• NVCRE version: current main
• Kubernetes version: envtest version pinned by the repository
• GPU architecture: not applicable
• Cloud provider / platform: not applicable
• Deployment method: any

Logs/Output

No controller log is required; this is an API admission behavior gap.

References

• ADR-079, Decision 6
• api/v1alpha1/job_types.go
• api/v1alpha1/workflow_types.go (JobTemplateSpec.Spec)