Enforce token-exchange/token-broker mutex at webhook admission (fail-fast)

Summary

The token-exchange XOR token-broker mutex (both claim the outbound Authorization header) is currently enforced only at render time in synthesizePresetPipeline (operator/internal/webhook/injector/preset_pipeline.go:182-187), not at webhook admission.

Consequence: a CR such as pluginPreset: full + plugins: ["token-broker:enforce"] is admitted at kubectl apply, then fails later at pod injection with a confusing error — the worst failure mode (accepted, breaks at runtime).

Introduced in #524.

Proposed fix

Add the mutex check to the admission path. ValidateCreate/ValidateUpdate → checkPluginPresetValid → AgentRuntimeSpec.ValidatePlugins() already exists and already validates plugin tokens at admission; the mutex is the one invariant that leaks to render time. It's fully determinable from the spec alone (static preset membership + spec plugins tokens), so it can be checked at admission for fail-fast UX at CR-creation time.

Two implementation notes:

• Import cycle: ValidatePlugins lives in the leaf api/v1alpha1 package specifically to avoid an injector import cycle, while the preset-membership tables live in the injector package. Moving the mutex to admission likely means relocating a slim membership map into the api package. Low-risk, but not zero.
• Keep both checks (add, don't move): retain the render-time guard as defense in depth — the synthesis path shouldn't assume admission ran (pre-existing CRs, or a webhook with failurePolicy: Ignore).

Raised as a non-blocking review suggestion by @cwiklik on #524.

Start in operator/internal/webhook/injector/preset_pipeline.go at synthesizePresetPipeline and trace ValidateCreate/ValidateUpdate through checkPluginPresetValid to AgentRuntimeSpec.ValidatePlugins(). Review the existing preset-membership tables and admission validation tests, then add admission coverage for the token-exchange/token-broker XOR case while preserving the render-time guard. Done means conflicting specs fail at CR admission and the existing render-time defense remains covered.