[Task]: Verify project ownership and stop treating 409 as success

Description

CreateHarborProject currently treats HTTP 409 Conflict as a success. While safe under per-namespace isolation, in a shared multi-tenant Harbor instance, a 409 means another tenant likely owns that project.

Ignoring the 409 and immediately creating a robot account creates a critical security flaw: it hands one tenant push and pull credentials to another tenant's private images. This ownership check serves as the primary defense against cross-tenant access when two Registry objects race or share identical names.

Decide first

Determine where to store the project ownership marker either in Harbor project metadata or Harbor labels. Select the option based on two criteria:

• The marker must survive Harbor upgrades.
• The marker must be readable without requiring additional API calls.

Acceptance criteria

1. Every project created by the operator must store an ownership marker recording its associated Registry (cluster, namespace, and name).
2. On HTTP 409, fetch the existing project's marker and proceed only if it matches the reconciling Registry.
3. On a 409 conflict for a foreign project, halt reconciliation immediately. Do not create a robot account, set resource quotas, or write a credentials Secret.
4. Treat any project without an ownership marker as foreign. Implicit adoption is prohibited.
5. Record the refusal as both a Kubernetes Event and a Status Condition on the resource so it is visible via kubectl describe without needing operator logs.

Out of scope

An adoption path for pre-existing or unmarked projects. (Any future adoption mechanism must be an explicit, opt-in action, not an automatic side effect of creating a Registry.)

Verification

• Verify reconciliation proceeds normally when encountering 409 on a project owned by the matching Registry.
• Verify reconciliation fails terminally when encountering 409 on a project owned by a different tenant, confirming no robot account or Secret is created.
• Verify reconciliation fails terminally on a project missing an ownership marker.

Start by locating CreateHarborProject and the reconciliation path that handles Harbor HTTP 409 responses. Compare Harbor project metadata and labels against the upgrade-survival and no-extra-API-call requirements, then inspect existing event and Status Condition patterns. Done means ownership is recorded, matching projects proceed, foreign or unmarked projects halt before credentials or quotas, and both verification cases pass.