refactor: extract dereference/validate pipeline from reconcile_airflow (#795)

* refactor: derive Ord/PartialOrd on AirflowRole

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: extract dereference/validate pipeline from reconcile_airflow

Move external resource resolution (product image, auth, authz, internal
secrets) into controller::dereference module with its own error enum.
Extract config validation and merging into validate_cluster(), which
produces a ValidatedAirflowCluster proving all product-config validation
succeeded before any Kubernetes resources are created.

The validated struct owns the resolved product image and per-role/
per-rolegroup merged configs. Existing build functions are unchanged
and receive their parameters from the validated structs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: restore fernet key length comment in dereference module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: restore kubernetes executor comment in validate_cluster

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: extract validate_cluster into controller::validate module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: align error variant naming with hive and hbase operators

Rename ProductConfigTransform to GenerateProductConfig and fix
the display string casing to match the convention used across
all three dereference/validate extraction PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: move product image resolution from dereference to validate

Image resolution is a pure computation, not an I/O dereference, so it
belongs in validate_cluster alongside the other config validation. This
also aligns with the pattern used by the trino operator.

The dereference error variants were renamed to drop the `Invalid` prefix
(e.g. InvalidAuthenticationConfig → AuthenticationConfig) because
removing ResolveProductImage left all remaining variants sharing the
same prefix, triggering clippy::enum_variant_names.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: move secret creation from dereference to reconciler

Secret creation is a side effect that should not happen before the
cluster spec has been validated. Moved it to the reconciler, after
validate_cluster succeeds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* changelog

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67

CHANGELOG.md

@@ -22,6 +22,7 @@
 - BREAKING: Renamed and moved the `celeryExecutor` broker and results backend to `clusterConfig` ([#786]).
   The results backend `spec.celeryExecutors.resultBackend` is now `spec.clusterConfig.celeryResultsBackend`.
   The broker `spec.celeryExecutors.broker` is now `spec.clusterConfig.celeryBroker`.
+- Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#795]).
 
 ### Fixed
 
@@ -37,6 +38,7 @@
 [#754]: https://github.com/stackabletech/airflow-operator/pull/754
 [#784]: https://github.com/stackabletech/airflow-operator/pull/784
 [#786]: https://github.com/stackabletech/airflow-operator/pull/786
+[#795]: https://github.com/stackabletech/airflow-operator/pull/795
 
 ## [26.3.0] - 2026-03-16