Remove dead webhook manifests that would break clusters if applied

Summary

Two ValidatingWebhookConfiguration manifests define webhooks for 3 resources with failurePolicy: Fail, but zero webhook handlers exist in the codebase. If these manifests were accidentally applied to a cluster, ALL CREATE/UPDATE requests for the affected resources would fail because the webhook endpoints return connection errors.

Severity: MUST FIX
Area: Webhooks
Breaking: No

Location

• cmd/thv-operator/config/webhook/manifests.yaml
• config/webhook/manifests.yaml

Problem

The manifests define webhooks for MCPExternalAuthConfig, VirtualMCPCompositeToolDefinition, and VirtualMCPServer, but:

• Zero +kubebuilder:webhook markers in any Go file
• Zero SetupWebhookWithManager() functions
• Zero ValidateCreate/ValidateUpdate/ValidateDelete implementations
• Zero webhook registrations in main.go
• The Helm chart has no webhook templates

Impact

• Cluster-breaking risk if manifests are accidentally applied
• Confusing codebase — manifests suggest webhooks exist when they don't
• The main.go starts a webhook server on port 9443 that serves nothing (see #4627)

Recommended Fix

Option A (clean up dead code — recommended):

1. Delete both manifests.yaml files
2. Remove WebhookServer from main.go (#4627)
3. Document the validation model (CEL + reconciler) as an explicit design decision

Option B (implement webhooks):

1. Add +kubebuilder:webhook markers and handler code
2. Add Helm templates for webhook Service, cert-manager Certificate, ValidatingWebhookConfiguration
3. Wire up in main.go

Related Issues

• Remove unused webhook server listening on port 9443 (#4627)
• Extract mutation from Validate method into separate defaulting logic (#4628)

Start by inspecting cmd/thv-operator/config/webhook/manifests.yaml and config/webhook/manifests.yaml, then check main.go and the related #4627 issue to separate this cleanup from the webhook-server change. Verify that no webhook handlers or registrations exist, and consider how the validation model should be documented. Done means the dead manifests no longer remain without leaving references that imply active webhooks.