Improvement: Fail API deployment when policy resolution fails at startup

Summary

During gateway-controller startup, when policyResolver.ResolvePolicies(apiConfig) returns validation errors, the current implementation logs a warning and skips policy derivation while the API configuration remains in configStore and continues to be routable. This creates a fail-open condition where an API may be routed without proper policy enforcement.

Desired Behavior

If policy resolution fails for an API at startup, the API deployment itself should also fail. The API configuration should be removed from configStore (e.g., via configStore.Delete(apiConfig.UUID)) so that it is not routable without its derived policies.

Current Behavior

• Policy resolution errors are logged as warnings.
• The API remains in configStore and is routable without derived policies.
• All other code paths (api_deployment.go, llm_deployment.go, restapi/service.go, api_processor.go) treat ResolvePolicies errors as fatal and abort the operation.

Steps to Reproduce

1. Configure an API with a policy that references a secret.
2. Arrange for the secret resolution to fail (e.g., missing secret, decryption failure).
3. Restart the gateway-controller.
4. Observe that the API is still routable but without its expected policies.

Suggested Fix

In gateway/gateway-controller/cmd/controller/main.go, when validationErrors is non-empty during startup policy derivation, call configStore.Delete(apiConfig.UUID) before continue, log any delete error, and add a follow-up log entry to aid observability. This aligns startup behavior with the fail-safe posture used elsewhere in the codebase.

References

• PR: https://github.com/wso2/api-platform/pull/1438
• Review comment: https://github.com/wso2/api-platform/pull/1438#discussion_r2985560944
• Requested by: @nimsara66