fix(storageclass): ignore vcluster-managed host mirrors

[weicao]

Problem

With sync.fromHost.storageClasses.enabled=true and an empty selector on a shared host, host StorageClasses created by another vCluster carry vcluster.loft.sh/managed-by and vcluster.loft.sh/object-name. The mirror mapper can map those objects onto a guest name before the host StorageClass syncer evaluates its selector. This can import stale long-name mirrors, overwrite an annotation-mapped guest StorageClass, or make selector-mismatch cleanup delete the wrong guest object.

Current-state evidence from the TiDB KB1.2 lane shows one baseline host default StorageClass, one old vCluster-managed translated host collision, the corresponding guest collision, and host-storageclass delete attempts failing on RBAC. This is a syncer contract issue, not a TiDB product failure.

Change

• Reject host StorageClasses carrying the vCluster managed marker before physical-event mapping/admission.
• Defensively ignore managed host objects in SyncToVirtual.
• During an already-enqueued reconcile, delete only a stale guest mirror whose name exactly equals the managed host name.
• Never delete or overwrite a different guest name reached through object-name annotation mapping.
• Leave the managed host StorageClass untouched; no host delete permission is required.

Tests

• Managed host StorageClass admission is false while a baseline host StorageClass remains admitted.
• Managed host StorageClass cannot create a guest object.
• Same-name stale guest mirror is removed while the managed host UID/object remains unchanged.
• Annotation-mapped different-name guest collision is neither deleted nor overwritten.
• Existing baseline host-to-guest create/update/delete behavior remains covered.

Validated on aaff9e25ea2650a4429e5d46ae04bb248e6023ca:

go test ./pkg/controllers/resources/storageclasses

go test ./pkg/controllers/resources/...

go test ./pkg/mappings/... ./pkg/syncer/...

git diff --check

All pass. Runtime evidence is intentionally not claimed by this PR; the pre-release image is for a separate focused live gate.