feat: ServiceOffer controller + PaymentRoute CRD (replaces monetize.py)

[bussyjd]

Summary

Production-ready Kubernetes controller for ServiceOffer CRDs using controller-runtime. Replaces the 1927-line monetize.py Python reconciliation loop with a generation-driven Go operator. Introduces PaymentRoute CRD to eliminate the ConfigMap mutation race. Refactors the x402-verifier to watch PaymentRoute CRs via dynamic informer.

Refs: #296

Architecture

Two Deployments, one binary family:

Component	Runtime	Scales on	Failure impact
serviceoffer-controller (obol-system ns)	controller-runtime, leader election	CR count	Stops convergence (not user-visible)
x402-verifier (x402 ns)	HTTP server + PaymentRoute informer	Request QPS	Drops ForwardAuth (user-visible)

ServiceOffer CR → controller derives:
  ├── Middleware (traefik.io ForwardAuth)
  ├── PaymentRoute CR (obol.org) ──→ verifier watches, builds route table
  └── HTTPRoute (gateway API)

What changed

Before	After
monetize.py polls every 10-60s	Informer fires on CR events (sub-second)
Runs inside obol-agent pod	Own Deployment, independent
ConfigMap string append/remove race	PaymentRoute CR per route (no race)
No finalizer	Finalizer ensures cleanup on any deletion
Single phase string	Conditions array + observedGeneration
File watcher in verifier (60-120s)	PaymentRoute informer (sub-second)

Files

Path	Action	Purpose
cmd/serviceoffer-controller/main.go	New	Controller binary
internal/controller/reconciler.go	New	Generation-driven reconcile loop
internal/controller/helpers.go	New	Spec parsing, conditions, GVK matcher
internal/controller/resources.go	New	Middleware, PaymentRoute, HTTPRoute builders
internal/controller/reconciler_test.go	New	12 unit tests
internal/x402/source/paymentroute.go	New	PaymentRoute informer for verifier
internal/x402/source/paymentroute_test.go	New	4 source tests
internal/x402/verifier.go	Modified	Added Config() accessor
cmd/x402-verifier/main.go	Modified	PaymentRoute informer replaces file watcher
internal/embed/.../paymentroute-crd.yaml	New	PaymentRoute CRD definition
internal/embed/.../serviceoffer-controller.yaml	New	SA + ClusterRole + Deployment
Dockerfile.serviceoffer-controller	New	Distroless container
internal/embed/skills/sell/scripts/monetize.py	Deleted	Replaced by controller
internal/x402/watcher.go	Deleted	Replaced by PaymentRoute informer
CLAUDE.md	Modified	Document new architecture

Net: +1,900 lines Go, -1,984 lines Python

Test plan

• go build ./... passes
• go test ./internal/controller/ — 12 tests pass (spec parsing, conditions, ownerRefs, phases)
• go test ./internal/x402/source/ — 4 tests pass (PaymentRoute conversion, validation)
• Deploy to cluster: obol sell http → verify PaymentRoute CR created → verify 402 response
• Delete ServiceOffer → verify PaymentRoute cleaned up via ownerRef cascade
• Kill controller pod → verify verifier continues serving existing routes