Clean up stale references left by the Jobs migration

[ayuskauskas]

Note

The Jobs migration (#223) merged to main in #459 on 2026-08-15. The
feature/package-as-jobs branch has been deleted — base this work on main,
which now executes packages as Jobs.

Part of #223. Refs #411 (item 10). Docs and comments only, no behavior change.

Checklist

• docs/uninstall.md:357 attributes a failure mode to SkyhookReconciler.UpdateNodeState, a method removed by this epic.
• operator/api/v1alpha1/legacy_readonly_webhook.go:37 documents a guard that depends on scripts/gen_nodewright.sh, deleted here (no build or CI break — nothing referenced the script or a verify-nodewright-gen target at the parent commit either).
• The design doc's reference list (docs/designs/2026-07-10-package-execution-as-jobs.md:283) points at the legacy skyhook_types.go for Package.stageTimeout and its webhook validation; both live in the nodewright group.
• The design doc's Job label set and its three copy-pasteable kubectl get jobs -l ... examples (around line 215) use the skyhook.nvidia.com/* prefix; the implementation stamps nodewright.nvidia.com/*, so every example command selects nothing.
• cmd/manager/main.go:131: the Cache-options comment states that nothing on the main manager reads a Secret, but SecretCertWatcher is registered on that manager and does — a future reader trusting it could delete the scoped entry and break webhook cert sync with a runtime 403 rather than a compile error.