fix(controlplane): clarify duckling provisioning readiness

[EDsCODE]

Summary

• keep Duckling CR, Lakekeeper CR/Secret/SA, warehouse, and OAuth client names derived from the org ID without bucket-specific compaction
• remove the stale dehyphenated Duckling lookup path so Kubernetes resource names stay injective and predictable
• require provisioning org IDs to be canonical lowercase hyphenated UUIDs; this gives the charts-owned S3 bucket compaction a safe input shape without pushing bucket constraints into Duckgres names
• split generic Duckling status parsing from provisioning readiness checks that inspect composed S3 Bucket readiness explicitly
• expose EnsureDeleted so the controller requests deletion and waits for Kubernetes finalizers without encoding delete semantics locally
• move Duckling client Kubernetes fixture coverage into k8s_client_test.go and centralize composed resourceRef lookup

Test plan

• go test -tags kubernetes ./controlplane/...
• go test -tags kubernetes ./controlplane/provisioner
• just lint skipped at requester direction; local golangci-lint was not installed in this environment

Agent context

Implemented from code review feedback and follow-up direction on Duckling naming, provisioning readiness, deletion boundaries, and test organization. I re-audited the hyphen-related diff after moving bucket-name compaction to PostHog/charts#12206: Duckgres now preserves org-derived resource names and only validates the provisioned org ID shape so charts can safely render compact S3 bucket names. No private operational identifiers are included.