reflector: add generation tracking for stale cache entry detection

[kaddynator]

Background

After a watch reconnect, the reflector cache may still contain entries from the previous watch cycle that have not yet been confirmed by a new event. There is currently no way for callers to distinguish a freshly-confirmed entry from one that may be stale (e.g. a pod that was deleted while the watch was down).

What this adds

A lightweight generation counter on ResourceReflector:

• self._generation — incremented after each successful _list_and_update, marking a new watch cycle
• self._entry_generations — a parallel dict stamping each cache entry with the generation in which it was last seen. Raw k8s resource dicts in self.resources are not modified.
• is_stale(ref_key) — returns True when an entry carries a generation older than the current watch cycle

Thread safety note

self.resources and self._entry_generations are updated on consecutive lines, so there is a brief window of inconsistency between the two dicts. is_stale() is advisory: a caller that races here will either see the old generation (slightly conservative — may re-query the API when it did not need to) or the new one (correct). It will never see an inconsistent state that causes a crash or incorrect action. This matches the existing comment on self.resources that callers accept a potentially out-of-date view.

How to use

pod_key = f"{namespace}/{pod_name}"
if self.pod_reflector.is_stale(pod_key):
    # re-query the API instead of trusting the cached value
    ...

No breaking changes

Existing callers that do not call is_stale() are unaffected. The generation counter adds two small dicts and one integer increment per watch cycle.