fix: isolate workload discovery failures by group version

[loosekite]

What changed

• Check support using only the target workload GroupVersion result instead of failing on the aggregate result from all API groups.
• Keep target discovery fail-closed: target errors still skip the watcher, and a missing target GVK remains unsupported.
• Preserve the existing multi-cluster requirement that every current member cluster supports the target GVK.
• Add regression coverage for unrelated aggregated API failures, target failures, and multi-cluster behavior.

Why

The controller currently calls ServerGroupsAndResources while deciding whether to register each workload watcher. If any unrelated aggregated API group fails discovery (for example, an empty response from metrics/v1alpha1), discovery returns a partial-result error and the controller skips otherwise-supported workload watchers such as CollaSet. The webhook can still pause the workload, but the missing watcher prevents rollout reconciliation from advancing it.

The memory discovery cache already stores results per GroupVersion. Reading the target GroupVersion result isolates unrelated failures without weakening the safety boundary for the target workload type.

Related issue

Fixes #163

Verification

• go test ./pkg/controllers/rollout -run Discovery -count=1
• go test -race ./pkg/controllers/rollout -run Discovery -count=1
• go test ./pkg/controllers/rollout -run 'Test(SingleClusterDiscovery|MultiClusterDiscovery|construct|resolve)' -count=1
• go vet ./pkg/controllers/rollout
• git diff --check