topology-updater: wait for NodeResourceTopology CRD at startup

[ArangoGutierrez]

What this PR does / why we need it

This fixes an issue where nfd-topology-updater pods would crash repeatedly (CrashLoopBackOff) when the NodeResourceTopology CRD was not installed, providing an unhelpful error message.

Changes

• Add waitForNodeResourceTopologyCRD() that waits with exponential backoff (5s to 60s max) for the CRD to become available
• Move HTTP server startup earlier so health probes pass during CRD wait
• Add RBAC permission for topology-updater to read CRDs
• Handle Forbidden errors gracefully (skip wait if no permission)
• Improve error message when NRT creation fails due to missing CRD
• Update documentation with CRD requirements section

How it works

Pod starts → HTTP server starts (health OK) → Check CRD
                                                   ↓
                                            CRD missing?
                                            ↙         ↘
                                         Yes           No
                                          ↓             ↓
                                   Wait & retry    Continue normal operation
                                   (5s→10s→...→60s)

This handles:

• Race conditions during deployment where CRD is created after topology-updater starts
• System admin scenarios where CRD is installed separately
• Graceful degradation when RBAC permissions are missing

Which issue(s) this PR fixes

Fixes #2145

Special notes for your reviewer

• The HTTP server is now started earlier in the initialization sequence so that health probes pass while waiting for the CRD
• RBAC permissions to read CRDs are added to both Helm chart and kustomize base
• If the ServiceAccount lacks permission to check CRDs (Forbidden error), the wait is skipped and the actual NRT creation will fail with a descriptive error

Does this PR introduce a user-facing change?

nfd-topology-updater now waits for the NodeResourceTopology CRD to be available at startup instead of crashing, handling deployment race conditions gracefully.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ArangoGutierrez

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ArangoGutierrez]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

👷 Deploy Preview for kubernetes-sigs-nfd processing.

Name	Link
🔨 Latest commit	ff78d4b
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-nfd/deploys/696a6df64601b8000872923c