Config: support restricting the bpfman daemon to a subset of nodes

Follow-up to #532, where we agreed to track `nodeSelector` separately ([comment](https://github.com/bpfman/bpfman-operator/pull/532#issuecomment-5071731420)).

### Use case

Our workers are split into a traffic-serving pool that uses bpfman and an internal pool (build agents, CI, internal tooling) that never needs eBPF. Programs are already scoped with `BpfApplication.spec.nodeSelector`, so on the internal pool the agent loads nothing and idles in `NotSelected` — but those nodes still run 2 DaemonSet pods with 4 privileged containers, `hostNetwork: true`, and bidirectional mounts of `/sys/fs/bpf` and `/var/lib/kubelet/pods`. The resource cost is secondary; the driver is not wanting privileged host-network workloads on nodes with no functional need for them.

### Why this isn't just a new CRD field

`controllers/bpfman-operator/common.go` lists every node in the cluster and expects a `BpfApplicationState` object from each one. A node without an agent never produces one, so adding `nodeSelector` today would leave every `BpfApplication` stuck in `Pending` with no actionable error.

The expected node set needs to be derived from where the daemon is actually scheduled instead of an unconditional node list.

### Things to get right

- Deriving the set from *ready* daemon pods would report `Success` while a node is briefly uncovered — scheduled-but-not-ready is the safer signal.
- An empty set (daemon fully down) must not make every application vacuously `Success`.
- `Success` changes meaning from "loaded on every node" to "loaded on every node running the daemon", so coverage should be visible in status.

Happy to work on this.

Start in controllers/bpfman-operator/common.go, where the operator currently lists cluster nodes and expects BpfApplicationState objects. Trace how scheduled-but-not-ready daemon pods could define the expected node set, then review BpfApplication status handling. Done means applications evaluate coverage only on daemon nodes, expose that coverage, and do not report Success when the daemon set is empty.

Written by the indexing model from the issue text.